CCNA Lab - Solution Rev1.0 MPLS VPN

♦ Configure PE1 Serial0/0 to ASBR1 Serial 0/2 interface with frame-relay encapsulation; make sure to use back-to-back serial.. S - Switch, H - Host, I - IGMP, r - Repeater Device ID Loca

Trang 1

In this lab IS-IS is slightly different than in other labs so please read the questions very carefully

We are going to extend IS-IS to PE4 across ASBR1 and ASBR2 In this lab ASBRs will become the P routers

Task 14.1:

♦ Configure IS-IS between RR1, PE1, PE2, and PE3

♦ IS-IS AREA NET 48.0000

♦ IS-IS RR1 AREA NET 48.0000.0254.0254

♦ IS-IS Level 1 in RR1: Configure IS-IS Level 1 only for both interfaces by using a single command

♦ RR1: Advertise VLAN20 and VLAN30, including the Loopback in Level 1

♦ Use best practices to advertise Loopbacks under IS-IS

♦ Configure RR1 such that all changes in IS-IS are sent to logging console

♦ PE1 IS-IS AREA NET 48.0000.0001.0001.00 Level 1

♦ CORRECTION!!! PE3 IS-IS AREA NET 48.0000.0003.0003.00 Level 1

PE1

interface Loopback0

ip address 10.1.1.1 255.255.255.255

! interface FastEthernet0/0 description to PE3 VLAN31

ip address 172.16.13.1 255.255.255.0

ip router isis speed 100 full-duplex isis circuit-type level-1 !

interface Serial0/0 description to Inter-AS ASBR1

Trang 2

encapsulation frame-relay

no keepalive

! interface Serial0/0.101 multipoint description to Inter-AS ASBR1 ISIS

ip address 172.16.222.1 255.255.255.0

ip router isis frame-relay map clns 201 broadcast frame-relay map ip 172.16.222.1 201 broadcast frame-relay map ip 172.16.222.2 201 broadcast

no frame-relay inverse-arp !

interface FastEthernet0/1 description to PE2 VLAN21

ip address 172.16.12.1 255.255.255.0

ip router isis speed 100 full-duplex isis circuit-type level-1

! router isis net 48.0000.0001.0001.00 log-adjacency-changes all passive-interface Loopback0 maximum-paths 1

hostname PE2-RACK1

! interface Loopback0

ip address 10.1.1.2 255.255.255.255

! interface Ethernet0/0

no ip address half-duplex

! interface Ethernet0/0.20 description to RR - VLAN 20 encapsulation dot1Q 20

ip address 172.16.20.2 255.255.255.0

ip router isis tag-switching ip isis circuit-type level-1

! interface Ethernet0/0.21 description to PE1 - VLAN 21 encapsulation dot1Q 21

ip address 172.16.12.2 255.255.255.0

ip router isis

no snmp trap link-status isis circuit-type level-1

Trang 3

ip address 172.16.123.2 255.255.255.0

ip router isis

! interface Ethernet0/1 description to BB1-RACK1

ip address 10.12.1.2 255.255.255.0

ip policy route-map unicast-routes full-duplex

! router isis net 48.0000.0002.0002.00 log-adjacency-changes all passive-interface Loopback0

hostname PE3-RACK1

ip address 10.1.1.3 255.255.255.255

ip address 33.33.33.33 255.255.255.0

no ip address half-duplex

! interface Ethernet0/0.23 description to CE2 - VLAN 23 encapsulation dot1Q 23

no snmp trap link-status

! interface Ethernet0/0.30 description to RR - VLAN 30 encapsulation dot1Q 30

ip address 172.16.30.3 255.255.255.0

ip router isis isis circuit-type level-1

ip address 172.16.13.3 255.255.255.0

ip router isis isis circuit-type level-1

ip address 172.16.123.3 255.255.255.0

ip router isis !

router isis net 48.0000.0003.0003.00 is-type level-1

Trang 4

log-adjacency-changes all passive-interface Loopback0

hostname RR1-RACK1

ip address 10.1.1.254 255.255.255.255

no ip address full-duplex

! interface Ethernet0/0.20 description to PE2 -VLAN 20 encapsulation dot1Q 20

ip address 172.16.20.254 255.255.255.0

ip router isis

! interface Ethernet0/0.30 description to PE3 -VLAN 30 encapsulation dot1Q 30

ip address 172.16.30.254 255.255.255.0

ip router isis

! router isis net 48.0000.0254.0254.00 is-type level-1

log-adjacency-changes all passive-interface Loopback0

This task is very similar to Lab 4 and Lab 5 so the explanation of solutions is not required to avoid unnecessary repetition The main focus of this task is on MPLS VPN and IS-IS just an IGP

Task 14.2:

Task 14.3:

♦ Establish IS-IS Level 1 adjacencies on the link between PE2 and PE3 over VLAN123

♦ Use best practices to advertise Loopbacks under IS-IS

♦ Configure PE1 Serial0/0 to ASBR1 Serial 0/2 interface with frame-relay encapsulation; make sure to use back-to-back serial

♦ Configure PE1 as sub-interface S0/0.100 multipoint Use the DLCI number of your choice on both routers

Trang 5

♦ Configure ASBR1 Serial 0/2 interface to PE1 with encapsulation frame-relay, back-to-back

♦ On ASBR1, configure using the physical interface instead of a sub-interface

♦ Configure all necessary frame-relay parameters to establish basic IP connectivity from PE1 to ASBR1 such that you do not depend on Inverse ARP for frame-relay interfaces on PE1 and ASBR1

♦ Establish Level 2 IS-IS adjacencies link between PE1 and ASBR1

♦ Configure all necessary components to establish IS-IS with PE1 over a multipoint interface

♦ Make sure you can ping PE1 Loopback0 10.1.1.1 from ASBR1

♦ ASBR1 IS-IS AREA NET 48.0000.1001.1001.00 Level 2

♦ ASBR2 IS-IS AREA NET 48.0000.2002.2002.00 Level 2

PE4

interface Loopback0

ip address 10.1.1.4 255.255.255.255

! router isis net 48.0000.0004.0004.00 is-type level-2-only log-adjacency-changes all passive-interface Loopback0

Select your own NET ID number for IS-IS

interface Loopback0

ip address 10.1.1.200 255.255.255.255

! router isis net 48.0000.2002.2002.00 is-type level-2-only log-adjacency-changes all passive-interface Loopback0

PE4-RACK1#sho ip route isis 10.0.0.0/32 is subnetted, 2 subnets

Trang 6

S - Switch, H - Host, I - IGMP, r - Repeater

Device ID Local Intrfce Holdtme Capability Platform Port ID ASBR2-RACK1 Ser 0/0 135 R S 2610 Ser 0/0 ASBR2-RACK1 Ser 0/1 135 R S 2610 Ser 0/1

ASBR1-RACK1(config)#int ser 0/0 ASBR1-RACK1(config-if)#ip router isis ASBR1-RACK1(config-if)#isis circuit-type level-2-only ASBR1-RACK1(config-if)#int ser 0/1

ASBR1-RACK1(config-if)#ip router isis ASBR1-RACK1(config-if)#isis circuit-type level-2-only

ASBR2-RACK1(config)#int ser 0/0 ASBR2-RACK1(config-if)#ip router isis ASBR2-RACK1(config-if)#isis circuit-type level-2-only ASBR2-RACK1(config-if)#int ser 0/1

ASBR1-RACK1(config-if)#ip router isis ASBR2-RACK1(config-if)#isis circuit-type level-2-only

♦ Configure IS-IS such that traffic does not get load-balanced across the two links

ASBR2-RACK1#sho ip route is 3.0.0.0/24 is subnetted, 1 subnets

i L2 3.3.3.0 [115/30] via 172.16.114.1, Serial0/1 [115/30] via 172.16.113.1, Serial0/0 140.100.0.0/24 is subnetted, 1 subnets

i L2 172.16.222.0 [115/20] via 172.16.114.1, Serial0/1 [115/20] via 172.16.113.1, Serial0/0

Trang 7

i L2 10.1.1.4 [115/10] via 172.16.240.4, Ethernet0/0

ASBR2-RACK1(config)#router isis ASBR2-RACK1(config-router)#maximum-paths 1

ASBR1-RACK1(config)#router isis ASBR1-RACK1(config-router)#maximum-paths 1

ASBR1-RACK1#sho ip route isis 3.0.0.0/24 is subnetted, 1 subnets

i L2 3.3.3.0 [115/20] via 172.16.222.1, Serial0/2 140.100.0.0/24 is subnetted, 1 subnets

i L2 140.100.2.0 [115/20] via 172.16.222.1, Serial0/2 172.16.0.0/24 is subnetted, 8 subnets

♦ Configure PE4 link to ASBR2 in IS-IS Level 2 only

♦ Configure SP1 and SP2 to communicate and exchange IS-IS routing table

♦ PE4 must be able to reach RR1

PE4-RACK1#ping 10.1.1.254 Type escape sequence to abort

Sending 5, 100-byte ICMP Echos to 10.1.1.254, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/20/24 ms

Trang 8

Task 14.5:

♦ Configure RR1 as route-reflector for all backbone routers in AS

65001

♦ Minimize configuration commands for BGP in SP1 core

♦ Configure IPv4 session only

♦ Configure Loopbacks for all PEs as shown in table below PE1-AS65001-SP1 Loopback 11 11.11.11.11/24

♦ Advertise Loopbacks in AS65001

♦ RR1 should inject Loopback55 without using network

commands Make sure only the 55.55.55.55 Loopback gets injected

♦ Verify that you can ping all BGP Loopbacks from RR1

RR1-RACK1

router bgp 65001

no synchronization bgp log-neighbor-changes network 172.16.20.0 mask 255.255.255.0 network 172.16.30.0 mask 255.255.255.0 redistribute connected metric 2 route-map allow55 neighbor ibgp peer-group

neighbor ibgp remote-as 65001 neighbor ibgp update-source Loopback0 neighbor ibgp route-reflector-client neighbor 10.1.1.1 peer-group ibgp neighbor 10.1.1.2 peer-group ibgp neighbor 10.1.1.3 peer-group ibgp

no auto-summary

! route-map allow55 permit 10 match ip address 55

! access-list 55 permit 55.55.55.0 0.0.0.255 log

This is the template for all PEs to peer with the Route Reflector

Trang 9

router bgp 65001

no synchronization bgp log-neighbor-changes neighbor 10.1.1.254 remote-as 65001 neighbor 10.1.1.254 update-source Loopback0

no auto-summary

Task 14.6:

♦ SP1 compliant with RFC-3214

This template should be applied to all SP1 routers:

PE1-RACK1(config)#mpls label protocol ldp PE1-RACK1(config)#mpls ip

PE1-RACK1(config)#int fas 0/0 PE1-RACK1(config-if)#mpls ip

♦ SP2 compliant with RFC-2105

PE4-RACK1(config)#mpls label protocol tdp PE4-RACK1(config)#mpls ip

PE4-RACK1(config-if)#in fastEthernet 0/0 PE4-RACK1(config-if)#tag-switching ip

For this task make sure that LDP is enabled on all ASBRs, otherwise the solution will not work

♦ Configure ASBR1 and ASBR2 as P routers only

Task 14.7:

The example below applies to all MPLS core routers:

This task will work by default if TDP and LDP configure

Task 14.8: Configure BB2 for legacy MPLS TCP/711 tag

Trang 10

Task 14.13:

In this task make sure you are going to redistribute IS-IS in EIGRP, otherwise all backbone routes will not match Based on task 14.11 this requires redistributing between IS-IS and EIGRP

interface ATM1/0.300 tag-switching

ip address 140.100.2.1 255.255.255.0 mpls label protocol tdp

tag-switching atm vp-tunnel 3 vci-range 33-65535 tag-switching ip

! router eigrp 100 redistribute isis level-1-2 metric 1544 1000 255 255 4460 network 140.100.2.0 0.0.0.255

no auto-summary

! router isis net 48.0000.0001.0001.00 area-password iementor authentication mode md5 level-2 authentication key-chain iementor level-2 log-adjacency-changes all

redistribute eigrp 100 metric 10 metric-type external level-1-2 redistribute isis ip level-2 into level-1 distribute-list 100 passive-interface Loopback0

maximum-paths 1

BB2-RACK1#sho tag-switching interfaces Interface IP Tunnel Operational ATM1/0.300 Yes No Yes (ATM tagging)

BB2-RACK1#sho tag-switching forwarding-table Local Outgoing Prefix Bytes tag Outgoing Next Hop tag tag or VC or Tunnel Id switched interface

Trang 11

Destination: 172.16.114.0/24 Headend Router ATM1/0.300 (1 hop) 3/74 Active, VCD=81 Destination: 10.1.1.2/32

Headend Router ATM1/0.300 (1 hop) 3/75 Active, VCD=82 Destination: 10.1.1.3/32

Headend Router ATM1/0.300 (1 hop) 3/80 Active, VCD=87

BB2-RACK1#sho ip route eigrp 172.16.0.0/24 is subnetted, 5 subnets

D EX 172.16.240.0 [170/1915904] via 140.100.2.1, 00:04:15, ATM1/0.300

D EX 172.16.113.0 [170/1915904] via 140.100.2.1, 00:04:15, ATM1/0.300

D EX 172.16.114.0 [170/1915904] via 140.100.2.1, 00:04:15, ATM1/0.300 10.0.0.0/8 is variably subnetted, 7 subnets, 2 masks

! router eigrp 100 network 140.100.2.0 0.0.0.255

Å Include Loopback 0 – 4

auto-summary

Task 14.14:

♦ Configure BB1 in AS57

Trang 12

♦ Advertise all interfaces without configuring network statements

in BB1

♦ Configure BB1 BGP session to PE2 using hash-md5

router bgp 57

no synchronization bgp log-neighbor-changes network 10.12.1.0 mask 255.255.255.0 redistribute connected metric 2 neighbor 10.12.1.2 remote-as 65001 neighbor 10.12.1.2 description to AS65001-SP1-PE2 neighbor 10.12.1.2 password iementor

no auto-summary

Task 14.15:

Configure PE2 to support VPN Green site 1

♦ Make sure VPN routes exchange is bi-directional

♦ Configure eBGP as the routing protocol for PE-CE communication between PE2 and BB1, with BB1 in AS57

♦ Verify if you can ping Loopbacks of BB1 from PE2

PE2-RACK1(config-vrf)#ip vrf green PE2-RACK1(config-vrf)# rd 100:100 PE2-RACK1(config-vrf)#route-target both 100:100

ip vrf green

rd 100:100 route-target export 100:100 route-target import 100:100

PE2-RACK1#config t Enter configuration commands, one per line End with CNTL/Z

PE2-RACK1(config-vrf)#int e 0/1 PE2-RACK1(config-if)#ip vrf forwarding green

% Policy Based Routing is NOT supported for VRF interfaces

% IP-Policy can be used ONLY for marking (set/clear DF bit) on VRF interfaces

% Interface Ethernet0/1 IP address 10.12.1.2 removed due to enabling VRF green

PE2-RACK1(config)#int e 0/1 PE2-RACK1(config-if)#ip address 10.12.1.2 255.255.255.0

PE2-RACK1#ping vrf green 10.12.1.1 Type escape sequence to abort

Trang 13

!!!!!

PE2-RACK1(config)#router bgp 65001 PE2-RACK1(config-router)# address-family ipv4 vrf green PE2-RACK1(config-router-af)# redistribute connected PE2-RACK1(config-router-af)# neighbor 10.12.1.1 remote-as 57 PE2-RACK1(config-router-af)# neighbor 10.12.1.1 activate PE2-RACK1(config-router-af)# no auto-summary

PE2-RACK1(config-router-af)# no synchronization PE2-RACK1(config-router-af)# exit-address-family

PE2-RACK1#sho ip bgp vpnv4 all summary Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

B 38.1.1.0 [20/2] via 10.12.1.1, 00:00:59 5.0.0.0/24 is subnetted, 1 subnets

B 5.5.5.0 [20/2] via 10.12.1.1, 00:00:59 156.46.0.0/16 is variably subnetted, 5 subnets, 2 masks

B 8.1.1.0 [20/2] via 10.12.1.1, 00:01:00

B 209.112.65.0/24 [20/2] via 10.12.1.1, 00:01:00

B 209.112.66.0/24 [20/2] via 10.12.1.1, 00:01:00 10.0.0.0/24 is subnetted, 1 subnets

C 10.12.1.0 is directly connected, Ethernet0/1

B 209.112.67.0/24 [20/2] via 10.12.1.1, 00:01:00

B 12.1.1.0 [20/2] via 10.12.1.1, 00:01:00

B 28.3.1.0 [20/2] via 10.12.1.1, 00:01:00

B 209.112.70.0/24 [20/2] via 10.12.1.1, 00:01:00

!!!!!

Trang 14

Task 14.16:

CE8 is required to advertise Loopback0 8.8.8.8/24 and Loopback8 88.88.88.1/30 via RIP

CE8-RACK1(config)#router rip CE8-RACK1(config-router)# version 2 CE8-RACK1(config-router)# network 8.0.0.0 CE8-RACK1(config-router)# network 88.0.0.0 CE8-RACK1(config-router)# network 10.0.0.0 CE8-RACK1(config-router)# no auto-summary

CE8-RACK1#sho ip rip d 8.0.0.0/8 auto-summary 8.8.8.0/24 directly connected, Loopback0 10.0.0.0/8 auto-summary

10.82.1.0/24 directly connected, FastEthernet0/0

♦ Advertise RIP routes to PE2

♦ Configure RIP as the routing protocol for PE-CE communication between PE2 and CE8

PE2-RACK1(config-subif)#ip vrf forwarding green

% Interface Ethernet0/0.82 IP address 10.82.1.2 removed due to enabling VRF green

PE2-RACK1(config-subif)#ip address 10.82.1.2 255.255.255.0

PE2-RACK1#sho ip vrf interfaces Interface IP-Address VRF Protocol

Et0/1 10.12.1.2 green up Et0/0.82 10.82.1.2 green up

PE2-RACK1#sho ip rip database vrf green 8.0.0.0/8 auto-summary

8.8.8.0/24 [1] via 10.82.1.1, 00:00:11, Ethernet0/0.82 10.0.0.0/8 auto-summary

10.12.1.0/24 directly connected, Ethernet0/1 10.82.1.0/24 directly connected, Ethernet0/0.82

♦ Verify if you can ping Loopbacks of VPN Green site 2 from PE2

PE2-RACK1(config)#router rip PE2-RACK1(config-router)# address-family ipv4 vrf green PE2-RACK1(config-router-af)# network 10.0.0.0

PE2-RACK1(config-router-af)# no auto-summary

Trang 15

PE2-RACK1(config-router-af)# version 2 PE2-RACK1(config-router-af)# exit-address-family

!!!!!

Task 14.17:

Site 1 should be able to communicate with site 2

♦ Limit the amount of routes PE2 receives from site 1 to 18 without using an access-list

CE8-RACK1#ping 5.5.5.5 Type escape sequence to abort

!!!!!

ip vrf green

rd 101:101 route-target export 101:101 route-target import 101:101 maximum routes 18 100 reinstall 100

! router rip !

address-family ipv4 vrf green redistribute bgp 65001 metric transparent network 10.0.0.0

no auto-summary version 2 exit-address-family

! router bgp 65001

no synchronization bgp log-neighbor-changes network 10.12.1.0 mask 255.255.255.0 network 22.22.22.0 mask 255.255.255.0 neighbor 10.1.1.254 remote-as 65001 neighbor 10.1.1.254 update-source Loopback0 neighbor 10.12.1.1 remote-as 57

neighbor 10.12.1.1 description Peer to BB1-AS57

no auto-summary !

address-family ipv4 vrf green redistribute connected

redistribute rip metric 10 neighbor 10.12.1.1 remote-as 57

Trang 16

neighbor 10.12.1.1 activate

no auto-summary

no synchronization exit-address-family

Task 14.18:

♦ CE1 is required to advertise Loopback0 1.1.1.1/24

♦ Customer’s remote side does not support any routing protocols, only statics

♦ Advertise static routes to PE3 from VPN IEMENTOR site 2

♦ Configure static routing for PE-CE communication between PE3 and CE2

♦ Verify if you can ping Loopbacks of VPN IEMENTOR site 2 from

PE3

ip vrf iementor

rd 200:200 route-target export 200:200 route-target import 200:200

! router bgp 65001

no synchronization bgp log-neighbor-changes network 33.33.33.0 mask 255.255.255.0 neighbor 10.1.1.254 remote-as 65001 neighbor 10.1.1.254 update-source Loopback0

no auto-summary !

address-family ipv4 vrf iementor redistribute connected

redistribute static metric 2

no auto-summary

no synchronization exit-address-family

q

PE3-R q q ACK1(config)#ip route vrf iementor 1.1.1.0 255.255.255.0 10.13.1.1

PE3-RACK1#ping vrf iementor 1.1.1.1 Type escape sequence to abort

Trang 17

♦ Configure PE1 to accept EIGRP as PE-CE routing protocol

♦ Verify if you can ping Loopbacks of VPN IEMENTOR site 1 from

PE1

router eigrp 100 auto-summary !

address-family ipv4 vrf iementor network 140.100.1.0 0.0.0.255

no auto-summary autonomous-system 10 exit-address-family

PE1-RACK1#sho ip route vrf iementor 18.0.0.0/24 is subnetted, 1 subnets

D 18.2.2.0 [90/229888] via 140.100.1.1, 00:09:24, ATM1/0.100 3.0.0.0/24 is subnetted, 1 subnets

C 140.100.1.0 is directly connected, ATM1/0.100 8.0.0.0/24 is subnetted, 1 subnets

D 28.3.2.0 [90/229888] via 140.100.1.1, 00:09:24, ATM1/0.100

PE1-RACK1#ping vrf iementor 3.3.3.3 Type escape sequence to abort

!!!!!

Task 14.20:

router bgp 65001 bgp log-neighbor-changes neighbor ibgp peer-group neighbor ibgp remote-as 65001 neighbor ibgp update-source Loopback0 neighbor 10.1.1.1 peer-group ibgp neighbor 10.1.1.2 peer-group ibgp neighbor 10.1.1.3 peer-group ibgp

Định dạng
Số trang	35
Dung lượng	272,14 KB