Subject: RE: Route Distinguisher Id

From: "Suryanarayana, Ananth" <[email-masked]>
Date: Thu, 17 Oct 2002 11:18:00 -0400

It seems, if RD is unique per VPN, then it logically correct as RD's purpose
is after all to distinguish routes with same prefixes amogst different vpns.
But, I am not sure how it can be implemented? 

for eg: consider the case in which three are three CE routers CE1(belonging
to VPN1). CE2 (belonging to VPN2) and CE3 (belonging to both VPN1 and VPN2)
attached to a single PE.

A sample configuration for this would be having three VRFs  as

CE1---attached to VRF1 (Import RT 1:1 and 1:3, Export RT 1:1) RD 1:1
(Belongs to VPN1)
CE2---attached to VRF2 (Import RT 1:2 and 1:3, Export RT 1:2) RD 1:2
(Belongs to VPN2)
CE3---attached to VRF3 (Import RT 1:1 and 2:2, Export RT 1:3) RD 1:3 (?)
(Belongs to both VPN1 and VPN2)

Suppose, if both CE1 and CE3 send a VPN1 route 5.5.5.0/24 to the edge router
PE with itself as the next-hops, then PE is suppose to select the best route
among these routes. But since route from CE1 (attached ro VRF1) will have RD
1:1 which is different from that of route advertised from CE3 (Attached to
VRF3, which will be 1:3), they will not be comparable.

Now, in this case, if configurable RDs supported are only one per VRF, how
can we ensure that route selection process is corectly made by making RD
unique per VRF. If we want to make it unique per VPN, does it mean, multiple
(default) RDs per VRF support is required?

Thanks,

Ananth

-----Original Message-----
From: Rubens Gomes [mailto:[email-masked]]
Sent: Wednesday, October 16, 2002 3:39 PM
To: [email-masked]
Subject: Route Distinguisher Id

My company (www.diveo.net.br) is getting ready to implement MPLS VPN in its 
IP backbone.  Right
now,  we are in the process of establishing conventions and strategies to 
name and identify things like
RDs, vrfNames, and such in the VPN VRFs.

A question has been raised regarding the strategy to be used for the RDs.  
Should the RD be unique
per VPN?  That is, within the same VPN, use the same RD in the different 
VRFs?  Or should we use a
distinct RDs for each VRF in the network?  From the perspective of network 
management it appears
to make sense to  use the same RD in a VPN because that would facilitate the

correlation of VPNs
with RDs.  However, someone else here raised the possiblity  of NOT having 
unique routes when the
same RD is used, and is aiming at unique RDs in the network.  Here is 
basically what this person has
raised:

aim: make routes unique, distinguish between VRF on same PE
set: on the VRF and attached to all routes when redistributed into MP-BGP
rule 1: no 2 VRFs on the same PE may have the same RD
rule 2: the combination of <RD>:<ipv4 address> (=VPNV4-address) needs to be
unique in the provider network as BGP (MP-BGP) only forwards the best route 
(otherwise load-balance
won't happen on redundant links)

The bottonline: Should RDs be unique or not?

Rubens S. Gomes
http://www.rubens-gomes.com

_________________________________________________________________
Unlimited Internet access -- and 2 months free!  Try MSN. 
http://resourcecenter.msn.com/access/plans/2monthsfree.asp

---

From: "Shiv Agarwal" <[email-masked]>
Date: Thu, 17 Oct 2002 10:34:29 -0700

Ananth,

2547 says that .............
<---------------->
1.3. VPNs with Overlapping Address Spaces

   We assume that any two non-intersecting VPNs (i.e., VPNs with no
   sites in common) may have overlapping address spaces; the same
   address may be reused, for different systems, in different VPNs.  As
   long as a given endsystem has an address which is unique within the
   scope of the VPNs that it belongs to, the endsystem itself does not
   need to know anything about VPNs.
<---------------->
In your case VPN1 and VPN2 are intersecting because the site CE3 is common to both VPNs. So your case is not valid. If you want to support this kind of scenario then you could define two VRFs at CE3, one participating in VPN1 and another in VPN2. Each of the 2 VRFs should have a different RD. For access side(CE), you may use 2 separate sub interfaces and map them to the 2 VRFs, one to each.

Shiv.

-----Original Message-----
From: Suryanarayana, Ananth [mailto:[email-masked]]
Sent: Thursday, October 17, 2002 8:18 AM
To: 'Rubens Gomes'; [email-masked]
Subject: RE: Route Distinguisher Id

Thanks,

Ananth

-----Original Message-----
From: Rubens Gomes [mailto:[email-masked]]
Sent: Wednesday, October 16, 2002 3:39 PM
To: [email-masked]
Subject: Route Distinguisher Id

correlation of VPNs

Rubens S. Gomes

---

From: "Shiv Agarwal" <[email-masked]>
Date: Thu, 17 Oct 2002 11:53:26 -0700

Ananth,

inline>>>>

Shiv.

-----Original Message-----
From: Suryanarayana, Ananth [mailto:[email-masked]]
Sent: Thursday, October 17, 2002 11:40 AM
To: Shiv Agarwal; Suryanarayana, Ananth; [email-masked]
Subject: RE: Route Distinguisher Id

Does it mean, in this case, if the CE is running BGP for exchanging routes
at CE, then there must be one BGP  session per vpn that it belongs to ?

Shiv>>> that depends on the implementation.

Also, it requires one connection per vpn between CE and PE? I was thinking
that, all the configurations are managed within the PE by using VRFs, RDs
and Route targets where as, a CE routes is associated with just one vrf over
one interface and they just have to "mention" the vpns they wish to belong
to.

From the cisco book "MPLS and VPN Architectures: Page 154, Note), I read
"All sites that share the same routing information (usually it means that
they belong to the same set of vpns) that are allowed to communicate
directly with each other, and that are connected to the same PE router can
be placed in a common VRF.

Shiv>>> where does it say that these common sites can have overlapping IP Addresses??

If I apply to this example, there is only one site C3, that belongs to the
set of VPNS VPN1 and VPN2 and hence C3 can be placed in a common single VRF.
Isn;t it?

Shiv>>> only if the VPNs have non overlapping ip address space.

thanks

Ananth

-----Original Message-----
From: Shiv Agarwal [mailto:[email-masked]]
Sent: Thursday, October 17, 2002 1:34 PM
To: Suryanarayana, Ananth; [email-masked]
Subject: RE: Route Distinguisher Id

Ananth,

   We assume that any two non-intersecting VPNs (i.e., VPNs with no
   sites in common) may have overlapping address spaces; the same
   address may be reused, for different systems, in different VPNs.  As
   long as a given endsystem has an address which is unique within the
   scope of the VPNs that it belongs to, the endsystem itself does not
   need to know anything about VPNs.
<---------------->
In your case VPN1 and VPN2 are intersecting because the site CE3 is common
to both VPNs. So your case is not valid. If you want to support this kind of
scenario then you could define two VRFs at CE3, one participating in VPN1
and another in VPN2. Each of the 2 VRFs should have a different RD. For
access side(CE), you may use 2 separate sub interfaces and map them to the 2
VRFs, one to each.

Shiv.

-----Original Message-----
From: Suryanarayana, Ananth [mailto:[email-masked]]
Sent: Thursday, October 17, 2002 8:18 AM
To: 'Rubens Gomes'; [email-masked]
Subject: RE: Route Distinguisher Id

Thanks,

Ananth

-----Original Message-----
From: Rubens Gomes [mailto:[email-masked]]
Sent: Wednesday, October 16, 2002 3:39 PM
To: [email-masked]
Subject: Route Distinguisher Id

correlation of VPNs

Rubens S. Gomes