Subject: Question about BGP/MPLS VPNs

From: Sachin Kalra <[email-masked]>
Date: Wed, 15 Jan 2003 17:06:12 -0500

Dear MPLS Community:

I would appreciate if someone can answer the following question about 
BGP-MPLS VPNs.

Lets say we have the following topology:

[CE1]                                                             [CE11]
         \                                                           /
         [PE1]-----------------[Rtr1]-------------------[PE2]
         /                                                           \
[CE2]                                                             [CE22]

1. PE and CEs have static routes configured between each other. i.e. no 
routing protocol running on the interfaces connecting PEs and CEs.

Question. How will a packet going from CE1 and destined to interface on PE2 
(that connects PE2 and CE11) reach its destination?

The problem is that when PE2 receives a packet destined to its out 
interface connecting "PE2->CE11". PE2 does not know that the packet is 
destined to itself. Because it just look at the bottom label of the packet, 
and as per the entries into its VRF table, PE2 just sends out the packet to 
CE11.

Is this the correct behavior?

I appreciate your response.
Thanks,
Sachin Kalra

---

From: Robert Raszuk <[email-masked]>
Date: Wed, 15 Jan 2003 23:09:35 +0100

Hi Sachin,

> Because it just look at the bottom label of the packet,

PE2 should based on the information retrived from the VPN label do the
vrf lookup which reveals that the packet is destined to itself. There is
no need to send it to CE11. 

R.

> Sachin Kalra wrote:

---

From: Sachin Kalra <[email-masked]>
Date: Wed, 15 Jan 2003 17:39:44 -0500

Hi Robert:

Thanks for the reply.

>no need to send it to CE11.

But shouldn't PE2 do a "NHLFE lookup" instead of "VRF lookup" when it gets 
a packet from PE1, with a label.

And if PE2 only does a NHLFE lookup then all it gets is an outgoing 
interface for the label. (In this case out iface will be the one connecting 
to CE11)

Please comment.
Thanks,
Sachin Kalra

*********************************************************************************
Just to be more clear, following is my VRF table at PE2. Where

1. "192.0.5.1" is the interface on PE2 (that connects PE2 and CE11).
2. "192.0.5.2" is the interface on CE11 (that connects CE11 and PE2).
3. "192.0.25.1" is the loopback interface on CE11.
4. "192.0.7.1", "192.0.1.1", "192.0.19.1" are PE1, CE1 and CE2 respectively

======================================================
VRF Table for VRF_A at PE2:

Destination       Subnet Mask        Next Hop      Out Iface    Bottom 
Label   Top Label
-----------            -----------                 ------------ 
---------        ------------           ---------
192.0.5.0          255.255.255.0      192.0.5.1       IF0             31 
                UNDEF
192.0.25.0        255.255.255.0      192.0.5.2       IF0             32 
               UNDEF
192.0.1.0          255.255.255.0      192.0.7.1       IF2             31 
                31
192.0.19.0        255.255.255.0      192.0.7.1      IF2             32 
              31
======================================================

> > I appreciate your response.

===========================================================
Sachin Kalra
Modeling Engineer
OPNET Technologies, Inc.
(240)-497-3000 x2796
===========================================================
Register for OPNET's Online Technology Workshops
(http://www.opnet.com/TechWorkshops/)
===========================================================

---

From: "Gopal@Cisco" <[email-masked]>
Date: Wed, 15 Jan 2003 15:13:34 -0800

Sachin, PLs see iinline...

Sachin Kalra wrote:
> But shouldn't PE2 do a "NHLFE lookup" instead of "VRF lookup" when it
> gets a packet from PE1, with a label.
> 
> interface for the label. (In this case out iface will be the one
> connecting to CE11)

OUtgoing interface is empty for connected routes in NHLFE. Just like
this,

R3#sho tag for tag 27
Local  Outgoing    Prefix            Bytes tag  Outgoing   Next Hop    
tag    tag or VC   or Tunnel Id      switched   interface              
27     Aggregate   10.10.33.0/24[V]  0                                  
R3#

> 192.0.5.0          255.255.255.0      192.0.5.1       IF0
> 31                   UNDEF
> 192.0.25.0        255.255.255.0      192.0.5.2       IF0
> 32                   UNDEF
> 192.0.1.0          255.255.255.0      192.0.7.1       IF2
> 31                   31
> 192.0.19.0        255.255.255.0      192.0.7.1      IF2
> 32                   31
> > > [CE1]
> > [CE11]
> > > [CE2]
> > [CE22]

-- 
Gopal(www-tac/~gnaganab),CCIE#6209,1.408.525.9922,RP-TAC,9:00AM-5:00PM(PST)
Cisco Systems Inc.-Changing the Way We Work, Live, Play and Learn

---

From: Robert Raszuk <[email-masked]>
Date: Thu, 16 Jan 2003 00:13:42 +0100

Some implementations do only LFIB lookup and send the packet blindely to
CE11 (then it bounces back) some use the concept of aggregate VPN label
and do VRF lookup after LFIB lookup on PE2 which allows route
aggregation among multiple sites connected to the same vrf or
loadbalancing. 

I think the rfc does not mandate the behviour here.

Rgs,
R.