IPv6 over MPLS or IPv6 VPN over MPLS on 280 series rotuers

fsebera · ‎12-03-2011

I have searched here as well as Google and cannot seem to find any confirmation of support of either IPv6 over MPLS on 2800 series routers or IPv6 VPN over MPLS on the 2800 series routers. I have fond a few documents on MPLS IPv4 over MPLS on 2800 series routers than confirm this setup.

The Topology:

MPLS Cloud

three 2811 routers running IOS 15.1 (latest advanced services) to perform the role of 6PE (and/or 6VPE) dual stacked IPv4/v6

three 2801 routers running IOS 15.1 (latest advanced services) to perform the role of P (IPv4) routers

MPLS protocol is LDP (unless I need to switch to TDP)

IGP of cloud is ISIS and peering between PEs is iBGP

Customer sites

three 1760 routers running latest IOS to perform the role of CE, dual stacked IPv4/v6

IGP for each customer site run OSPFv4 and OSPFv6, and peering with a single PE via eBGP

The issues:

1. IPv6 over MPLS states the command "mpls ipv6 source-interface loopback0" is needed for this version of MPLS

This command is not available on the 2800 series IOS.

2. IPv6 VPN over MPLS states the command "mls ipv6 vrf" is needed for this version of MPLS

This command is not available on the 2800 series IOS.

The 2 Questions:

1. Since the command "mpls ipv6 source-interface" is not available on the 2800 series, could I just assign the egress interfaces (toward "P" routers) an IPv4 AND IPv6 address and peer iBGP via these interfaces? Will this allow the mapped interface feature to function (::FFFF:ipv4-mapped-interface)?

2. Does the command "vrf definition (name)" replace the "mls ipv6 vrf" on the 2800 series IOS?

Do these two commands perform the same function?

The final question:

Do the 2800 series routers support IPv6 over MPLS or IPv6 VPN over MPLS or should I seek a different direction?

Thanks for ANY assistance!!!!

FYI, once I get this functioning, I can post the configs for all devices if anyone would like 'em!

Frank

Peter Paluch · ‎12-03-2011

Hi Frank,

To your issues and questions:

1. IPv6 over MPLS states the command "mpls ipv6 source-interface loopback0" is needed for this version of MPLS

This command is not available on the 2800 series IOS.

This command is not necessary. It was used before RFC 3484 to specify the source IP address of locally generated packets. The RFC 3484 defines the necessary procedures and as a result, this command is not even supported in recent IOSes.

2. IPv6 VPN over MPLS states the command "mls ipv6 vrf" is needed for this version of MPLS

This command is not available on the 2800 series IOS.

This command is, according to the IPv6 Command Reference, supported only on 7600 and ASR series routers. It is not relevant for 2800 series routers.

1. Since the command "mpls ipv6 source-interface" is not available on the 2800 series, could I just assign the egress interfaces (toward "P" routers) an IPv4 AND IPv6 address and peer iBGP via these interfaces? Will this allow the mapped interface feature to function (::FFFF:ipv4-mapped-interface)?

The point of 6PE is to have IPv6 addresses assigned only on PE-CE links, not towards P devices. You do not need to assign any IPv6 addresses nor run IPv6 within your MPLS cloud. The mapped route in the IPv6 routing table with the next hop set to ::FFFF:X.X.X.X where X.X.X.X is the peering address of the opposite PE router will work just fine.

In other words, you set IPv6 addresses on PE interfaces towards the CE devices and optionally run some IPv6 IGP on these links. You set up your provider cloud (PE and P routers) only with IPv4 addresses. Furthermore, you peer the PE devices in iBGP, enable the IPv6 address family and redistribute the routes from the PE/CE links and learned from CE routers into the BGP - and vice versa, towards the CE devices. Assuming your provider cloud is fully running MPLS, you're done.

2. Does the command "vrf definition (name)" replace the "mls ipv6 vrf" on the 2800 series IOS?

Do these two commands perform the same function?

No, they do not. The vrf definition is a protocol-neutral way of defining a VRF, without tying it to specifically IPv4 or IPv6 operation, as opposed to the older style of ip vrf. The mls ipv6 vrf is necessary on high-end routers like 7600 or ASRs, where, according to the documentation, this command is used to enable IPv6 processing in VRFs globally. Read more here:

http://www.cisco.com/en/US/docs/ios/ipv6/command/reference/ipv6_09.html#wp2372609

Do the 2800 series routers support IPv6 over MPLS or IPv6 VPN over MPLS or should I seek a different direction?

They definitely do support 6PE and 6VPE in recent IOSes, including yours.

Best regards,

Peter

fsebera · ‎12-05-2011

Hi Peter,

Thanks for the VERY quick reply!!! Much appreciated.

After some analysis and hours of futzing around with the IOS commands,

it appears the "main" IOS configuration difference between IPv6 over MPLS and IPv6 VPN over MPLS is this:

:

IPv6 over MPLS

Makes use of the BGP address-family ipv6 with ipv4 [iBGP] neighbor statement(s) with the "send-label" command

:

Where-as

:

IPv6 VPN over MPLS

Makes use of the BGP address-family ipv6 with ipv4 [iBGP] neighbor statement(s) with the "send-community extended" command.

:

And both setups require BGP:

address-family vpnv4 <--- iBGP peering - required

address-family vpnv6 <----iBGP peering - required

address-family ipv4 vrf <---- eBGP peering, and assuming CE-PE is BGP

address-family ipv6 vrf <---- eBGP peering, and assuming CE-PE is BGP

:

(and all the MPLS route target stuff too).

And as you have clearly pointed out, neither technology runs IPv6 on any "P" router or any interface connecting to a "P" router.

:

Is the above correct????

:

Thanks again.

Frank

Peter Paluch · ‎12-07-2011

Hello Frank,

IPv6 over MPLS 
Makes use of the BGP address-family ipv6 with ipv4 [iBGP] neighbor statement(s) with the "send-label" command

Yes. In particular, you do not create any VRF for 6PE.

IPv6 VPN over MPLS 
Makes use of the BGP address-family ipv6 with ipv4 [iBGP] neighbor statement(s) with the "send-community extended" command.

Perhaps there's a typo here in your command, but with 6VPE, you will use the address-family vpnv6 command and create a VRF for the customer connection in which you will place the IPv6 routes (and even IPv4 routes if necessary). The neighbor send-community extended command is, to my experience, added automatically into the address-family configuration (it essentially carries the route targets defined in VRFs).

Correctly, both setups require BGP.

Best regards,

Peter

Peter Paluch · ‎12-07-2011

Frank,

In addition, have you seen this presentation? It is a fine (and in-depth) overview of 6PE and 6VPE.

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6553/prod_presentation0900aecd80311df4.pdf

Best regards,

Peter

fsebera · ‎12-14-2011

This is a follow up from my previous question a few days ago; “Will IPv6/MPLS operate on Cisco 2800 Series routers?”.

I‘ve been busy researching the hell outta this thing and am proud to say I now have a fully functional working environment. My environment supports IPv6 over MPLS, IPv6 VPN over MPLS as-well-as Auto 6to4 tunneling across my MPLS cloud. All technologies are fully operational, simultaneously. (IPv4 across the MPLS cloud is obviously functional as well). I have 2 customers, 1 customer has 3 individual remote CE sites that peer with 3 different PE peering points. The second customer has 2 individual remote CE sites that peer with two of the PE peering points. Customer 1 has different AS numbers at each site and Customer 2 has the same AS number at both sites. The MPLS core consists of 3 P routers.

Thanks again for all your assistance!!!

Oh and to answer my initial question, “Will IPv6/MPLS operate on Cisco 2800 Series routers?”

The answer is an absolute YES!

Thanks and Best Regards

Frank

This is the basic difference between ipv6 over mpls verses ipv6 VPN over MPLS.

NOTE: – I only setup BGP peering in all cases.

IPv6 over MPLS

A PE router interfaces with a CE router over eBGP IPv6 address-family via a dedicated link. The ingress PE router, interfaces with the egress PE router through the MPLS cloud via IPv4 iBGP neighbor statements. Neighbor statements (IPv4 and IPv6) are configured under the global router BGP statement and activated under the IPv6 address-family. The IPv4 neighbor statements under the IPv6 address-family (yes you read this correctly, IPv4 under the IPv6) utilize the send-label command – this is how the two PE iBGP peering routers forwards IPv6 traffic across the IPv4 core I.E. encapsulated within labels. This mode does not use the VPNv6 address-family nor address-family vrf IPv#. PE-to-P and P-to-P utilize IGP IPv4 only. I use LDP with ISIS as the IGP in the MPLS core but see much documentation on TDP and OSPF. I guess that’ll work just fine too but I understand TDP is being phased out. All remote CE sites utilize unique AS numbers but could employ the same AS number (if CE’s employ the same AS#, you need to implement neighbor AS over-ride command, [at least you do for IPv6 VPN over MPLS]) and MPLS cloud is single AS.

If the IPv4 IPG (ISIS or OSPF) and LDP orTDP protocols are configured properly within the MPLS core and your global vrf definition to include import/export and IPv4/IPv6 address-family’s are in place, you are ready to roll.

One big draw back to this method – all CE IPv6 prefixes are in the same routing table, no separation of routing tables between CE’s of different customers. I suspect if this method is used massive prefix filtering may be in order.

:

Configuration example of IPv6 over MPLS:

router bgp 65000

neighbor 192.1681.2 remote-as 65000

neighbor 192.168.1.2 update-source loopback0

neighbor 192:168:1::1 remote-as 10

!

address-family ipv6

neighbor 192.168.1.2 activate

neighbor 192.168.1.2 send-label

neighbor 192:168:1::1 activate

:

Here is a link that covers the details – you need a CCO account, although the final configuration is flawed,

if you focus enough you are bound to figure it out – I did!

http://www.cisco.com/en/US/customer/docs/ios-xml/ios/ipv6/configuration/15-1s/ipv6-over-mpls.html

:

While

:

IPv6 VPN over MPLS

A PE router, interfaces with a CE router via IPv6 through the vrf interface command and CE to PE peering is performed within the BGP address-family IPv6 vrf . For the CE-to-PE peering, you could also employ static routing, RIP, EIGRP OSPF and or ISIS. Once the CE-to-PE peering portion of the configuration is setup, you should have CE prefixes in the IPv6 vrf routing table from your directly connected CE eBGP neighbor; provided you at least configured the redistribute connected on the CE side of the house. To enable communication between PEs (across the MPLS core) you need to configure IPv4 iBGP neighbor statements under the global BGP statement AND add IPv4 iBGP neighbor activate and send-community extended commands under the address-family VPNv6.

If the IPv4 IPG (ISIS or OSPF) and LDP/TDP protocol are configured properly within the MPLS core and your global vrf definition to include import/export and IPv4/IPv6 address-family’s are in place, you are ready to roll.

Configuration example of IPv6 VPN over MPLS:

router bgp 65000

neighbor 192.1681.1 remote-as 65000

neighbor 192.168.1.1 update-source loopback0

!

address-family vpnv6

neighbor 192.168.1.1 activate

neighbor 192.168.1.1 send-community extended

!

address-family ipv6 vrf (VRF name)

neighbor 172:19:10::1 remote-as 10

:

Here is a link that covers the details – you need a CCO account.

http://www.cisco.com/en/US/customer/docs/ios-xml/ios/ipv6/configuration/15-1s/ip6-ov-mpls-6vpe.html

Only issue I discovered that always consistently failed was the IPv6 peering addresses (CE to PE). If the eBGP peering between CE to PE utilized a subset of the CE’s aggregate address; eBGP peering is established but the PE will not advertise the CE’s prefix. (Perhaps this is the way aggregation operates but I didn’t see this issue in IPv4. Using the debug bgp all command (IN THE LAB ONLY), you receive an error “aggregate needs to be re-aggregated”.

:

And here is an example of the different IPv6 routing tables on PE1

IPv6 over MPLS

PE1#sh ipv6 route

IPv6 Routing Table - default - 13 entries

Codes: C - Connected, L - Local, S - Static, U - Per-user Static route

B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP

I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary

D - EIGRP, EX - EIGRP external, ND - Neighbor Discovery, l - LISP

O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2

ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2

B ::/0 [20/0]

via FE80::211:92FF:FEEC:A294, FastEthernet0/0.16

B 10::3/128 [200/0]

via 10.0.0.3%default, indirectly connected

C 172:17:10::/126 [0/0]

via FastEthernet0/0.16, directly connected

L 172:17:10::2/128 [0/0]

via FastEthernet0/0.16, receive

B 172:17:20::/126 [200/0]

via 10.0.0.2%default, indirectly connected

B 172:17:30::/126 [200/0]

via 10.0.0.3%default, indirectly connected

C 192:168:1::/64 [0/0]

via Loopback0, directly connected

L 192:168:1::2/128 [0/0]

via Loopback0, receive

B 192:168:2::/64 [200/0]

via 10.0.0.2%default, indirectly connected

B 4608:F300:FF4F:FEC0::/58 [200/0]

via 10.0.0.3%default, indirectly connected

B 4608:F300:FF4F:FF40::/58 [200/0]

via 10.0.0.2%default, indirectly connected

B 4608:F300:FF4F:FFC0::/58 [20/0]

via FE80::211:92FF:FEEC:A294, FastEthernet0/0.16

L FF00::/8 [0/0]

via Null0, receive

IPv6 VPN over MPLS (Customer RMMA with 3 remote sites)

PE1#sh ipv6 route vrf RMMA

IPv6 Routing Table - RMMA - 8 entries

Codes: C - Connected, L - Local, S - Static, U - Per-user Static route

B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP

I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary

D - EIGRP, EX - EIGRP external, ND - Neighbor Discovery, l - LISP

O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2

ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2

C 172:19:10::/126 [0/0]

via FastEthernet0/0.10, directly connected

L 172:19:10::2/128 [0/0]

via FastEthernet0/0.10, receive

B 172:19:20::/126 [200/0]

via 10.0.0.2%default, indirectly connected

B 172:19:30::/126 [200/0]

via 10.0.0.3%default, indirectly connected

B 1010::/48 [20/0]

via FE80::211:92FF:FEEC:A294, FastEthernet0/0.10

B 2020::/48 [200/0]

via 10.0.0.2%default, indirectly connected

B 3030::/48 [200/0]

via 10.0.0.3%default, indirectly connected

L FF00::/8 [0/0]

via Null0, receive

IPv6 VPN over MPLS (Customer ACDC with 2 remote sites)

PE1#sh ipv6 route vrf ACDC

IPv6 Routing Table - ACDC - 7 entries

Codes: C - Connected, L - Local, S - Static, U - Per-user Static route

B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP

I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary

D - EIGRP, EX - EIGRP external, ND - Neighbor Discovery, l - LISP

O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2

ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2

B ::/0 [20/0]

via FE80::213:80FF:FE63:D2C3, FastEthernet0/0.40

B AC::/64 [20/0]

via FE80::213:80FF:FE63:D2C3, FastEthernet0/0.40

B DC::/64 [200/0]

via 10.0.0.2%default, indirectly connected

C 172:17:10::/126 [0/0]

via FastEthernet0/0.40, directly connected

L 172:17:10::2/128 [0/0]

via FastEthernet0/0.40, receive

B 172:17:20::/126 [200/0]

via 10.0.0.2%default, indirectly connected

L FF00::/8 [0/0]

via Null0, receive