MPLS Overview
MPLS Overview
Multiprotocol Label Switching (MPLS):
• Uses labels to make packet forwarding decisions
• Flexible and efficient
• Supports many different services
MPLS Overview
Multiprotocol Label Switching (MPLS):
• Label Switch Router (LSR)
• Perform routing based on labels
MPLS Overview
Typical Router:
• Control Plane contains RIB
• RIB contains routes learned statically and dynamically
• Control Plane packets = destined to or originating from the router
• Data Plane contains FIB
• FIB makes IP destination prefix-based switching decisions
• Data Plane packets = not destined for the router itself
MPLS Overview
Label Switch Router (LSR):
• Control Plane contains Label Information Base (LIB)
• Data Plane contains Label Forwarding Information Base (LFIB)
• Labels are exchanged using Label Distribution Protocol (LDP)
• Normal routing information exchanged and populated in RIB
• LDP-exchanged labels are populated into the LIB
• LIB selects best path based on LDP-learned information
• LIB populates LFIB and FIB
• Unlabeled packets forwarded via FIB, labeled packets via LFIB
MPLS Overview
MPLS DOMAIN
10.0.0.0/24 20.0.0.0/24
Edge Intermediate Intermediate Intermediate Edge
LSR LSR LSR LSR LSR
Label Switched Path (LSP) = accumulative, unidirectional path
LSP to 20.0.0.0/24
MPLS Overview
FRAM I
PAYLOAD
HEADER HEADER
Layer 2 Layer 3
P
MPLS Overview
FRAM I
LABEL PAYLOAD
HEADER HEADER
Layer 2 Shim Header Layer 3
Label EXP S TTL
20 bits 3 bits 1 bit 8 bits
4-byte (32-bit) Shim Header
P
MPLS Layer 3 VPN
Customer A - Site 1 MPLS DOMAIN Customer A - Site 2
CE CE
P1
PE1 IGP PE2
P2
Customer B - Site 1 Customer B - Site 2
CE CE
MPLS Layer 3 VPN
Network: Network:
192.168.0.0/24 192.168.0.0/24
Customer A - Site 1 MPLS DOMAIN Customer A - Site 2
CE CE
P1
PE1 IGP PE2
P2
Customer B - Site 1 Customer B - Site 2
CE CE
VRF = Virtual Forwarding Instance that allows multiple routing tables
MPLS Layer 3 VPN
Network: Network:
192.168.0.0/24 192.168.0.0/24
Customer A - Site 1 MPLS DOMAIN Customer A - Site 2
CE CE
P1
PE1 IGP PE2
P2
Customer B - Site 1 Customer B - Site 2
CE CE
VRF CUST-A VRF CUST-B
MPLS Layer 3 VPN
Network: Network:
192.168.0.0/24 192.168.0.0/24
Customer A - Site 1 MPLS DOMAIN Customer A - Site 2
CE CE
P1
iBGP Peering
PE1 PE2
P2
Customer B - Site 1 Customer B - Site 2
CE CE
VRF CUST-A VRF CUST-B
PREFIX
MPLS Layer 3 VPN
Network: Network:
192.168.0.0/24 192.168.0.0/24
Customer A - Site 1 MPLS DOMAIN Customer A - Site 2
CE CE
P1
rd 100:1 iBGP Peering
PE1 PE2
P2
Customer B - Site 1 Customer B - Site 2
CE CE
rd 200:1
Route Distinguisher (rd) = 8-byte unique identifer for prefix
• Typical convention = ASN:SN
MPLS Layer 3 VPN
Network: Network:
192.168.0.0/24 192.168.0.0/24
Customer A - Site 1 MPLS DOMAIN Customer A - Site 2
CE CE
P1
rd 100:1 iBGP Peering
PE1 PE2
route-target
100:1
P2
Customer B - Site 1 Customer B - Site 2
CE CE
rd 200:1
Route Target (route-target) = 8-byte unique identifer for prefix
route-target
200:1 • Tells neighboring routers which VRF to place route into
MPLS Layer 3 VPN
Network: Network:
192.168.0.0/24 192.168.0.0/24
Customer A - Site 1 MPLS DOMAIN Customer A - Site 2
CE CE
P1
VPNv4 route
PE1 PE2
MP-BGP
P2
Customer B - Site 1 Customer B - Site 2
CE CE
VRF CUST-A VRF CUST-B VRF CUST-A VRF CUST-B
rd 100:1 rd 200:1 rd 100:1 rd 200:1
route-target route-target route-target route-target
100:1 200:1 100:1 200:1
DMVPN
DMVPN
Dynamic Multipoint Virtual Private Network (DMVPN):
• Commonly used to build VPNs between sites
• Full-mesh capable hub and spoke network
• Spoke-to-spoke tunnel establishment
DMVPN
Dynamic Multipoint Virtual Private Network (DMVPN):
• Multipoint Generic Routing Encapsulation (mGRE)
• Single router interface can form multiple GRE tunnels
DMVPN
Branch A
mGRE Interface
mGRE Interface
HQ Branch B
Branch C
DMVPN
Next-Hop Resolution Protocol (NHRP):
• Functionally similar to how DNS works
• Client-server model to resolve addresses
• DMVPN hub server has awareness of all addresses
DMVPN
Tunnel Interface IP: 10.1.1.5
Physical Interface IP: 192.168.10.5 Branch A
Dynamic Tunnel Formation
HQ Branch B
NHRP Database
Tunnel Interface IP Physical Interface IP
10.1.1.5 192.168.10.5 Branch C
GRE Addresses DMVPN 50.1.1.10/24
172.16.10.0/24 .1 PC1
.1 Branch A
20.1.1.0/24 Gig 0/1
10.1.1.0/24 .2
.2
30.1.1.0/24
.1 .2 .1
HQ Gig 0/1 Gig 0/1 Branch B
.2
40.1.1.0/24 Gig 0/1
.1 .1 PC2
Branch C
60.1.1.10/24
:
IPsec Protocols
Site-to-Site VPN
sVTI-Based VPN
