Cisco Service Control MPLS/VPN Solution Guide, Release 3.5.5
Available Languages
Table Of Contents
Cisco Service Control MPLS/VPN Solution Guide, Release 3.5.5
Introduction to the Service Control MPLS/VPN Solution
Cisco Service Control MPLS/VPN: the Challenge and the Solution
The Cisco MPLS-VPN Service Control Solution
Benefits for Service Providers
Overview of the Service Control Solution for MPLS/VPN Networks
Service Control in the MPLS/VPN Environment
What are the Challenges for Service Control for MPLS/VPN Support?
How the Service Control MPLS/VPN Solution Works
Service Control MPLS/VPN Concepts
Additional MPLS Pattern Support
Service Control MPLS/VPN Requirements
Configuring the MPLS Environment
How to Check the Running Configuration
How to Configure the MPLS Environment
How to Configure the SCE Platform for MPLS/VPN Support
About Configuring the SCE Platform for MPLS/VPN Support
How to Configure the MAC Resolver
How to Monitor the MAC Resolver
How to Configure the SM for MPLS/VPN Support
Configuring the SM for MPLS/VPN Support
How to Edit the SM Configuration File
How to Configure the SM to Allow IP Ranges
How to Manage MPLS/VPN Support via SNMP
How to Monitor MPLS/VPN Support via SCE Platform CLI
How to Display VPN-related Mappings
How to Clear Upstream VPN Mappings
How to Monitor Subscriber Counters
How to Monitor MPLS/VPN Counters
How to Monitor Non-VPN Mappings
How to Manage MPLS/VPN Support via SM CLU
How to Add Mappings to VPN-based Subscribers
How to Remove VPN Mappings from Subscribers
How to Monitor Subscriber MPLS/VPN Mappings
Obtaining Documentation and Submitting a Service Request
Cisco Service Control Solution Guide
Cisco Service Control MPLS/VPN Solution Guide, Release 3.5.5
Revised: August 4, 2009, OL-8822-061 About this Guide
This guide is for experienced network administrators who are responsible for configuring and maintaining the Service Control MPLS/VPN solution.
Document Revision History
The Document Revision History listed in Table 1 records changes to this document.
Table 1 Document Revision History
OL-8220-06
Release 3.5.5
August 4, 2009Versioned document to Release 3.5.5
OL-8822-05
Release 3.1.5
November, 2007Extensive changes describing the updated VPN functionality. (Many of the same changes as in Release 3.1.5LA, but published with general access.
OL-8822-04
Release 3.1.5LA
August, 2007Changes describing updated VPN functionality. (Published with limited access.)
OL-8822-03
Release 3.0.5
November, 2006Minor change regarding PE router with multiple IP interfaces (see How to Define the PE Routers)
OL-8822-02
Release 3.0.3
May, 2006Various minor changes.
OL-8822-01
Release 3.0.0
December, 2005Created the Cisco Service Control MPLS/VPN Solution Guide.
Related Publications
The following documentation contains additional information regarding the components of the Service Control MPLS/VPN solution:
•
For further information regarding general configuration of the Cisco Service Control solution, refer to the relevant guide:
–
–
–
•
–
–
•
In addition, the extensive features and functionality of the SCE platform and the software running on are documented in the following resources:
•
–
–
–
–
Note
•
–
–
–
–
•
–
2 Introduction to the Service Control MPLS/VPN Solution
This section explains how the Cisco Service Control MPLS/VPN solution was developed to solve the challenges faced by ISPs offering MPLS/VPN services.
Cisco Service Control MPLS/VPN: the Challenge and the Solution
•
•
Overview
Cisco offers a Service Control solution that is applicable for service providers who are either currently offering MPLS-VPN services to their customers, or planning to introduce such a service in the near-future. This service targets providers offering enterprise-focused solutions as well as those who are involved in offering MPLS-VPN services to their SOHO customers. This state-of-the-art solution allows complete visibility into the applications and services in MPLS-VPN tunnels for subscriber-based usage monitoring and billing, and leveraged for capacity control and for differentiation of service levels as well.
This solution incorporates the ability to monitor and control all the traffic in an MPLS-VPN tunnel as belonging to a single subscriber entity, including traffic with private non-routable IP addresses. Its advanced functionality facilitates the implementation the Cisco Service Control solution in MPLS-VPN environments, and the suite of capabilities that the solution provides.
The Challenge
Service providers that offer MPLS-VPN services are challenged in their ability to leverage their investment in the MPLS-VPN infrastructure. This lack of control hampers their ability to both reduce total cost of ownership and increase per customer revenue, aggregate revenue, and profitability.
These service providers need to:
•
•
•
The Cisco MPLS-VPN Service Control Solution
In the Cisco MPLS-VPN Service Control solution, Cisco has managed to overcome the technical challenge of classifying flows with private non-routable IP addresses into the correct MPLS-VPN that these flows are part of. The challenge originates from the fact that the SCE platform may have been incorrectly classifying the packets of these flows. The Cisco MPLS-VPN solution implements a unique learning algorithm that can successfully and reliably correctly classify multiple flows in multiple MPLS-VPN tunnels, even if they have the same private IP address.
The Cisco MPLS-VPN Service Control solution:
•
•
Benefits for Service Providers
With the Cisco Service Control MPLS-VPN solution, service providers can benefit from granular per subscriber and per application usage reports. This granularity allows for complete per subscriber and per application layer-7 visibility of the manner in which their MPLS-VPN subscribers are using the service provider's network. These reports can, for example, show:
•
•
•
These reports can be used by the service provider's network teams for capacity planning, and by the marketing teams for planning and rolling out new "tiers of service" packages.
As well as the data records that enable these reports, the solution generates data records that can be forwarded to mediation and billing systems and used for implementation of granular usage-based billing.
Service providers can also benefit from the Service Control MPLS-VPN solution by using the SCE platforms as network enforcement devices for a variety of per network-based services, such as:
•
•
This flexibility not only provides an extremely attractive return on investment, but protects your investment as your needs for network and application infrastructure evolves.
Using the Service Control infrastructure to create these next-generation services provides the path to enhanced customer revenue streams, differentiated service offerings, and a cost structure commensurate with the required business model.
3 Overview of the Service Control Solution for MPLS/VPN Networks
This section contains the following subsections:
•
•
•
•
Service Control in the MPLS/VPN Environment
MPLS/VPN networks are very complex and utilize many routing protocols and many different levels of addressing and control. In addition, the various VPNs may use overlapping IP addresses (private IPs).
The SCE platform makes a distinction between identical IP addresses that come from different VPNs, and maps them into subscribers according to the MPLS labels attached to the packets. This involves various mechanisms in all levels of the system.
The following assumptions and requirements allow the SCE platform to operate in an MPLS/VPN environment:
•
•
•
–
These labels are not mandatory for VPN classification, and some situations do not appear in the packet due to PHP or other reasons.
–
These labels are mandatory for VPN classification.
•
Note
Definitions and Acronyms
Table 2 defines important terms and acronyms.
What are the Challenges for Service Control for MPLS/VPN Support?
•
•
•
How MPLS/VPN Support Works
Service Control supports three mechanisms that make MPLS/VPN support work:
•
•
•
Flow Detection
Flow detection is the process of deciding which packets belong to the same flow. This relates to the first two challenges listed:
•
•
Flow detection is based on the MPLS labels, extending the basic 5 tuple that SCOS uses to identify flows, and taking into account the fact that in MPLS, the packet is labeled differently in each direction.
Since MPLS traffic is unidirectional, each direction is classified separately by the SCE platform, using the following:
•
Downstream labels are learned from the control plane (through the SM BGP LEG).
•
Upstream labels are learned from the data plane.
VPN Detection
The network configuration that provides the division into VPNs is controlled by the SM. The network-wide value that describes a VPN most closely is either the Route Target or the Route Distinguisher
•
•
The relevant module in the Subscriber Manager server (SM) is the BGP-LEG. The BGP-LEG is added to the BGP neighborhood for obtaining the information on the MPLS labels. The local PEs are configured to add the BGP-LEG as a BGP peer.
The SCE platform detects that a flow belongs to a certain VPN according to the downstream label that the flow carries, and the MAC address of the PE that it is sent to.
One VPN may spread over more than one PE router, as long as all the sites of the VPN are connected to the subscriber side of the same SCE platform
VPNs can be configured only via the SM. The SCE platform CLI can be used to view VPN-related information, but not to configure the VPNs.
Subscriber Detection
•
•
What is an MPLS/VPN-based Subscriber?
As in other modes of operation, in MPLS/VPN each flow belongs to a certain subscriber. A VPN-based subscriber is a part of a VPN. The VPN itself corresponds to a set of IP addresses that are managed separately and that belong to a specific ISP customer who pays for the VPN service.
An MPLS/VPN-based subscriber can be defined as either of the following:
•
•
The network configuration that provides the division into VPNs and VPN-based subscribers is controlled by the SM. (For more information, see the Cisco Service Control Management Suite Subscriber Manager User Guide.)
Private IP Subscriber Support
VPN-based subscribers can have private IP mappings, which are a combination of an IP range and a VPN mapping. Since the source of such mappings is typically in the BGP protocol, and they are received automatically from the protocol by the BGP agent, the IP ranges may contain overlapping ranges. The semantics of such overlaps is that of a longest prefix match.
For example, if subscriber A receives the range 10.0.0.0/8@VPN1 and subscriber B receives the range 10.1.0.0/16@VPN1, then the system maps IPs that start with 10.1 to subscriber B, and any other address that begins with 10 to subscriber A. Traffic with other IP addresses on VPN1 will be mapped to the unknown subscriber.
For private IP subscribers, flows are distributed to traffic processors according to the VPN, not according to the IP address. This means that all traffic from any one VPN is mapped to the same traffic processor.
How the Service Control MPLS/VPN Solution Works
•
•
•
•
How the Service Control MPLS/VPN Solution Works: A Summary
•
A VPN is identified by the RD / RT and the PE.
•
•
•
•
•
SCE Platform Tasks in the MPLS/VPN Solution
•
–
–
•
•
•
•
BGP LEG Tasks in the MPLS/VPN Solution
•
•
•
SM Tasks in the MPLS/VPN Solution
•
•
–
–
•
•
•
Service Control MPLS/VPN Concepts
•
Non-VPN-Based Subscribers
The MPLS/VPN solution supports the existence of non-VPN-based (regular IP) subscribers concurrently with the MPLS/VPN-based subscribers, with the following limitations and requirements:
•
•
•
In typical MPLS/VPN networks, traffic that does not belong to any VPN is labeled with a single MPLS label in the upstream direction, which is used for routing. The downstream direction of such flows typically contains no label, due to penultimate hop popping.
The SCE platform uses the one or more labels upstream and no label downstream definition to identify non-VPN flows. Classification and traffic processor load balancing on these flows is performed according to the IP header, rather than the label.
This process requires learning of the upstream labels in use for such flows, and is done using the flow detection mechanism described above (see Flow Detection).
Bypassing Unknown VPNs
In an MPLS network, there may be many VPNs crossing the SCE platform, only a small number of which require service control functionality. It is necessary for the SCE platform to recognize which VPNs are not managed.
•
•
Note that the label limit (see Limitations)of 57,344 different labels includes labels from the bypassed VPNs.
Each bypassed VPN entry, both upstream and downstream, is removed from the database after a set period of time (10 minutes). If the entry is still used in the traffic, it will be re-learnt. This allows the database to remain clean, even if the labels are reused by the routers for different VPNs.
show bypassed VPNs In the show bypassed VPNs command, the age is indicated with each label - the length of time since it was learned.
Additional MPLS Pattern Support
The MPLS/VPN solution was designed to provide DPI services in MPLS/VPN network. These networks use BGP protocol as the control plane for the VPNs and LDP protocol for routing. There are complex networks where the MPLS infrastructure is used not only for VPN and routing, but also for other features such as traffic engineering (TE) and better fail-over. These features are usually enabled per VRF in the PE.
The Service Control MPLS/VPN solution does not support VPNs that use other MPLS-related features. Features such as MPLS-TE or MPLS-FRR (Fast Reroute) are not supported. VPNs for which these features are enabled can be automatically bypassed in the system, but are not allowed to be configured in the SM as serviced VPNs. Configuration of these VPNs in the SM might cause misclassification due to label aliasing.
The following list describes the labels combinations that are supported by the SCE platform and how each combination is interpreted by the platform:
•
Assumed to be non-VPN (see Non-VPN-Based Subscribers).
The SCE platform treats the following IP flows as non-VPN flows, and ignores their labels.
•
Assumed to be VPN traffic, in which the P router happens to be the last hop in the upstream.
The label in the downstream is treated as a BGP label, like the regular case. If the BGP label is known from the SM, then the flow is assigned to the correct subscriber, otherwise, it is treated as a bypassed VPN.
•
This is the typical configuration of the system. Of the two upstream labels, one is for BGP and one for LDP. The downstream label is for BGP only
•
These combinations occur when other MPLS-related features are enabled for the VPN. Such VPNs are not supported and should not be configured in the SM. However, they can be bypassed in the SCE platform without any service and without harming the service for other VPNs.
VPN Identifier (RD or RT)
Either the Route Distinguisher (RD) attribute or the Route Target (RT) attribute can be used to identify the VPN. It is required to decide which attribute best reflects the VPN partitioning, and configure the system accordingly. Note that the configuration is global for all the VPNs, that is, all VPNs must be identified by the same attribute.
The Route Distinguisher (RD) is generally used to distinguish the distinct VPN routes of separate customers who connect to the provider, so in most cases the RD is a good partition for the VPNs in the network. Since the RD is an identifier of the local VRF, and not the target VRF, it can be used to distinguish between VPNs that transfer information to a common central entity (for example a central bank, IRS, Port Authority, and so forth.).
The Route Target (RT) is used to define the destination VPN site. Though it is not intuitive to define the VPN based on its destination route, it might be easier in some cases. For example, if all the VPN sites that communicate to a central bank should be treated as a single subscriber, consider using the RT as the VPN identifier.
It is important to note that this configuration is global. Therefore, if at some point in time, any VPN would have to be defined by RD, then all the other VPNs must be defined by RD as well. This is a point to consider when designing the initial deployment.
Service Control MPLS/VPN Requirements
Topology
Following are the general topology requirements for MPLS/VPN support:
•
•
•
•
It speaks with the SCE platform through the management IP.
In a Cascade Installation:
•
•
–
–
Figure 1 depicts a typical cascade installation.
Figure 1 Typical MPLs/VPN Installation
Capacity
The system supports:
•
–
•
•
–
Limitations
Note
Mutually Exclusive System Modes
When the system works in MPLS/VPN mode, the following modes are not supported:
•
–
–
–
–
•
•
•
Number of MPLS Labels
•
•
•
Subscriber-related Limitations
The following subscriber-related limitations exist in the current solution:
•
•
•
•
–
–
Topology-related Limitations
•
TCP Related Requirements
•
VPN Configuration Requirements
•
–
–
•
Backwards Compatibility
An SCE platform running SCOS V3.1.5 and up does not support MPLS/VPN subscribers of the type used in older versions. Instead of defining an MPLS/VPN subscriber, which reflects the whole VPN, the user must configure a VPN entity and a full range private IP subscriber within that VPN (0.0.0.0/0@VPN1)
When working with the combination of SM of a version before V3.1.5 and an SCE with V3.1.5 and up, only regular IP subscribers are supported. VPN-based subscribers are not supported at all in this combination.
4 Configuring MPLS/VPN Support
This module explains how to configure MPLS/VPN support. Both the SCE platform and the SM must be properly configured.
•
•
•
Configuring the MPLS Environment
In order for MPLS/VPN support to function, the environment must be configured correctly, specifically the following are required:
•
•
How to Check the Running Configuration
Check the running configuration to verify no user-configured values appear for tunneling protocols or VLAN support, indicating that they are all in default mode.
Step 1
Displays the running configuration.
Step 2
How to Configure the MPLS Environment
If either VLAN or tunneling support is in default mode, skip the relevant step in the following procedure.
Step 1
Configures VLAN support to default mode.
Step 2
Disables all other tunneling protocol support.
Note
Note
Step 3
Enables the MPLS auto-learning mechanism.
How to Configure the SCE Platform for MPLS/VPN Support
•
•
•
About Configuring the SCE Platform for MPLS/VPN Support
There are three main steps to configure the SCE platform for MPLS/VPN support:
1.
2.
3.
How to Define the PE Routers
Options
The following options are available:
•
•
–
–
–
•
Two interfaces cannot be defined with the same IP address, even if they have different VLAN tags. If such a configuration is attempted, it will simply update the VLAN tag information for the existing PE interface.
How to Add a PE Router
Each PE router that has managed VPNs behind it must be defined using the following CLI command.
Step 1
Defines the PE router with one interface IP address and optional VLAN tag. May also be used to add an additional interface IP address to an existing PE router.
How to Remove PE Routers
•
•
About Removing PE Routers
Use these commands to remove one or all defined PE routers.
Please note the following:
•
•
•
How to Remove a Specified PE Router
Step 1
Removes the specified PE router.
How to Remove All PE Routers
Step 1
Removes all configured PE routers.
How to Remove a Specified Interface from a PE Router
Step 1
Removes the specified interface from the PE router definition. The PE router itself is not removed.
How to Configure the MAC Resolver
•
•
About the MAC Resolver
The MAC resolver allows the SCOS to find the MAC address associated with a specific IP address. The MAC resolver must be configured when the SCE platform operates in MPLS/VPN mode, to translate the IP addresses of the provider edge router interfaces to their respective MAC addresses.
The MPLS/VPN mode needs the MAC resolver, as opposed to the standard ARP protocol, because ARP is used by the management interface, while MPLS/VPN uses the traffic interfaces of the SCE platform, which ARP does not include.
The MAC resolver database holds the IP addresses registered by the clients to be resolved. The IP addresses of the routers are added to and removed from the database in either of two modes:
•
In this mode, the system listens to ARP messages of the configured PE interfaces, and this way it stays updated with their MAC addresses. There is no configuration required when operating in dynamic mode.
–
•
•
In this mode, the MAC address of each PE router must be explicitly defined by the user.
–
–
However, for statically configured MAC addresses, a user log message appears when the system detects that the MAC address changed. This can be used by the operator to configure the new address.
These two modes can function simultaneously; therefore selected PE routers can be configured statically, while the rest are resolved dynamically
For more information regarding the MAC resolver, refer to the relevant software configuration guide:
•
•
•
Options
The following options are available:
•
•
•
How to Add a Static IP Address
Step 1
Adds the specified IP address and MAC address pair to the MAC resolver database.
How to Remove a Static IP Address
Step 1
Removes the specified IP address and MAC address pair from the MAC resolver database.
How to Monitor the MAC Resolver
Use this command to see a listing of all IP addresses and corresponding MAC addresses currently registered in the MAC resolver database.
Step 1
Displays a listing of all IP addresses and corresponding MAC addresses currently registered in the MAC resolver database.
How to Configure the SM for MPLS/VPN Support
•
•
•
Configuring the SM for MPLS/VPN Support
There are two main steps to configure the SM for MPLS/VPN support:
Step 1
See How to Edit the SM Configuration File
Step 2
Refer to the Cisco SCMS SM LEGs User Guide for more information.
How to Edit the SM Configuration File
The SM configuration file, p3sm.cfg, must be configured for the following:
•
•
How to Configure the SM for MPLS/VPN Support
Step 1
# The following section enables SM operation with MPLS-VPN support. [MPLS-VPN] # The following parameter defines the BGP attribute to use to identify VPN subscribers # possible values: "rd" or "rt". # (default: rt) vpn_id=rt
How to Configure the SM for Troubleshooting MPLS/VPN Support
An optional parameter may be turned on to facilitate troubleshooting the BGP LEG installation. This parameter turns on detailed logging of messages received from the BGP LEG. It should only be turned on when necessary for troubleshooting and should always be turned off for normal operation of the system.
Step 1
# The following parameter turns on detailed logging of messages received from the BGP LEG # should be changed to true only during troubleshooting # (default: false) log_all=true
How to Configure the SM to Allow IP Ranges
To setup the SM to work with MPLS/VPN, you must enable IP ranges by setting the support_ip_ranges in the configuration file.
Step 1
support_ip_ranges=yes
Note
5 Managing MPLS/VPN Support
This section explains how to manage MPLS/VPN support.
•
•
•
How to Manage MPLS/VPN Support via SNMP
SNMP support for MPLS/VPN auto-learn is provided in two ways:
•
•
MPLS/VPN MIB Objects
The mplsVpnAutoLearnGrp MIB object group (pcubeSEObjs 17) contains information regarding MPLS/VPN auto-learning.
The objects in the mplsVpnAutoLearnGrp provide the following information:
•
•
For more information, see the "Proprietary MIB Reference" chapter in the Cisco SCE 2000 and SCE 1000 Software Configuration Guide or the "Cisco Service Control MIBs" chapter in the relevant software configuration guide:
•
•
MPLS/VPN Traps
There is one MPLS/VPN-related trap:
•
To provide online notification of a resource deficiency, when the system reaches a level of 80% utilization of the hardware MPLS/VPN mappings, a warning message appears in the user log, and this SNMP trap is sent.
Both the warning and the trap are sent for each 100 mappings that are added after the threshold has been exceeded.
How to Monitor MPLS/VPN Support via SCE Platform CLI
The SCE platform CLI allows you to do the following:
•
•
•
•
How to Display VPN-related Mappings
Use the following Viewer commands to display subscriber mappings. These commands display the following information:
•
•
•
•
•
How to Display Mappings for a Specified VPN
•
Options
The following option is available:
•
Step 1
Displaying Mappings for a Specified VPN: Examples
The following example illustrates the output of this command for an MPLS-based VPN.
SCE# show interface linecard 0 VPN name vpn1 VPN name: Vpn1 Downstream MPLS Mappings: PE-ID = 1.0.0.1 Mpls Label = 20 PE-ID = 1.0.0.1 Mpls Label = 30 =======>Total Downstream Mappings: 2 Upstream MPLS Mappings: =======>Total Upstream Mappings: 0 Number of subscriber mappings: 0 Explicitly introduced VPNThe following example illustrates the output of this command for a VLAN-based VPN.
SCE> show interface linecard 0 VPN name Vpn3VPN name: Vpn3VLAN: 2Number of subscriber mappings: 0Explicitly introduced VPNThe following example illustrates the output of this command for an automatically created VLAN.
SCE> show interface linecard 0 VPN name 2VPN name: 2VLAN: 2Number of subscriber mappings: 1Automatically created VPNHow to Display a Listing of all VPNs
Use this command to display a listing of all currently logged-in VPNs
Step 1
Displaying a Listing of All VPNs: Example
SCE# show interface linecard 0 VPN all-namesHow to Display Subscriber Mappings for an IP range on a Specified VPN
•
Options
The following options are available:
•
•
Step 1
The VPN option allows you to search for subscribers with a private IP mapping
Displaying Subscribers Mapped to a IP range on a Specified VPN: Example
SCE# show interface linecard 0 subscriber mapping included-in IP 10.0.0.0/0 VPN vpn1 Subscribers with IP mappings included in IP range '10.0.0.0/0'@vpn1: Subscriber 'Sub10', mapping '10.1.4.150/32@vpn1'. Subscriber 'Sub10', mapping '10.1.4.149/32@vpn1'. Subscriber 'Sub10', mapping '10.1.4.145/32@vpn1'. Subscriber 'Sub11', mapping '10.1.4.146/32@vpn1'. Total 2 subscribers found, with 4 matching mappingsHow to Display the Number of Subscribers Mapped to an IP range on a Specified VPN
•
Options
The following options are available:
•
•
Use the `amount `keyword to display the number of subscribers rather than a listing of subscriber names.
Step 1
Displaying the Number of Subscribers Mapped to range on a Specified VPN: Example
SCE# show interface linecard 0 subscriber amount mapping included-in IP 0.0.0.0/0 VPN vpn1 There are 2 subscribers with 4 IP mappings included in IP range '0.0.0.0/0'.How to Display the Name of the Subscriber Mapped to a Specified VPN
If the MPLS/VPN is configured as a single subscriber mapped to 0.0.0.0/0 on the VPN that is mapped to the specified MPLS, this option displays that subscriber
Note
Step 1
•
•
Displaying the Subscriber Mapped to a Specified VPN: Example 1
SCE#>show interface lineCard 0 subscriber mapping MPLS-VPN PE-ID 1.0.0.1 BGP-label 30 BGP MPLS label 30 on PE 1.0.0.1 is mapped to VPN named 'Vpn1' The VPN is NOT mapped to a single subscriber (0.0.0.0/0@Vpn1)Displaying the Subscriber Mapped to a Specified VPN: Example 2
SCE#>show interface lineCard 0 subscriber mapping MPLS-VPN PE-ID 1.0.0.1 BGP-label 30 BGP MPLS label 30 on PE 1.0.0.1 is mapped to VPN named 'Vpn1' Subscriber 'Sub10' is mapped to 0.0.0.0/0@Vpn1How to Display the Mappings of Upstream Labels that Belong to Non-VPN Flows
Step 1
How to Clear Upstream VPN Mappings
Use this command to remove all learned upstream labels of a specified VPN.
Options
The following option is available:
•
Step 1
This command, in effect, causes early label aging. Clearing the mappings allows relearning; labels will probably be quickly relearned after they have been cleared. Therefore, this command is useful when you want to update the VPN mappings without waiting for the standard aging period.
How to Monitor Subscriber Counters
Use the following Viewer command to display subscriber counters, including those related to MPLS/VPN mappings.
•
About Subscriber Counters
When MPLS/VPN-based subscribers are enabled, the following related counters appear in addition to the basic subscriber counters:
•
–
–
•
•
–
–
•
Step 1
Monitoring Subscriber Counters: Example
SCE#show interface linecard 0 subscriber db counters Current values: =============== Subscribers: 2 used out of 99999 max. Introduced subscribers: 2. Anonymous subscribers: 0. Subscribers with mappings: 2 used out of 99999 max. SINGLE non-VPN IP mappings: 1. non-VPN IP Range mappings: 1. IP Range over VPN mappings: 1. Single IP over VPN mappings: 3. MPLS-based subscribers are enabled. MPLS/VPN mappings: 2 used out of 57344 max. MPLS based VPNs with subscriber mappings: 2 used out of 2015 max. Subscribers with open sessions: 0. Subscribers with TIR mappings: 0. Sessions mapped to the default subscriber: 0. Peak values: ============ Peak number of subscribers with mappings: 2 Peak number occurred at: 14:56:55 ISR MON June 9 2007 Peak number cleared at: 15:29:39 ISR MON June 9 2007 Event counters: =============== Subscriber introduced: 2. Subscriber pulled: 0. Subscriber aged: 0. Pull-request notifications sent: 0. State notifications sent: 0. Logout notifications sent: 0. Subscriber mapping TIR contradictions: 0How to Monitor MPLS/VPN Counters
Use the following Viewer command to display MPLS/VPN information.
Step 1
Monitoring MPLS/VPN Counters: Example
SCE#show interface linecard 0 mpls vpn MPLS/VPN auto-learn mode is enabled. MPLS based VPNs with subscriber mappings: 0 used out of 2015 max Total HW MPLS/VPN mappings utilization: 0 used out of 57344 max MPLS/VPN mappings are divided as follows: downstream VPN subscriber mappings: 0 upstream VPN subscriber mappings: 0 non-vpn upstream mappings: 0 downstream bypassed VPN mappings: 0 upstream bypassed VPN mappings: 0How to Monitor the PE Routers
Use the following Viewer commands to monitor PE routers. These commands provide the following information:
•
•
How to Display the Configuration of all Currently Defined PE Routers
Step 1
How to Display the Configuration of a Specified PE Router
Step 1
How to Monitor Bypassed VPNs
•
•
How to Display the Currently Bypassed VPNs
Step 1
How to Remove all Learned Bypassed VPNs
Step 1
How to Monitor Non-VPN Mappings
•
•
How to Display Non-VPN Mappings
Step 1
How to Remove all Learned non-VPN Mappings
Step 1
How to Manage MPLS/VPN Support via SM CLU
The SM CLU allows you to do the following:
•
•
•
For more information, see the Cisco Service Control Management Suite Subscriber Manager User Guide.
Managing VPNs
Use the p3vpn utility to manage VPNs.
•
•
Options
The following options are available:
•
•
–
Note that the Route Distinguisher may be specified rather than the route target
–
How to Add a New MPLS-based VPN
Step 1
--mpls-vpn=RT@PE,(RT@PE2, RT@PE3,...).
How to Remove a VPN
Step 1
How to Display VPN Information
•
•
To List All Existing VPNs
Step 1
To List All Subscribers for a Specified VPN
Step 1
Listing All Subscribers for a Specified VPN: Example
p3vpn -show-sub --vpn=vpn1 sub1: 10.1.1.0/24@vpn1 sub2: 20.1.1.0/24@vpn1 Command terminated successfullyTo Display the Mappings for a Specified VPN
Step 1
Listing All Subscribers for a Specified VPN: Example
p3vpn --show --vpn=vpn1 Name: vpn1 Domain: subscribers Mappings: MPLS/VPN: 1:1000@10.0.0.1 (no BGP information) MPLS/VPN: 1:1000@10.0.0.2 label: 10 IP range: 1.1.1.1/32 Command terminated successfullyHow to Manage VPN Mappings
•
•
To Remove All Existing Mappings from a Specified VPN
Step 1
To Remove a Specified Mapping from a Specified VPN
Step 1
How to Add Mappings to VPN-based Subscribers
There are three types of mappings that can be added to an existing VPN-based subscriber:
•
•
•
How to Add IP Address Mappings
Options
The following options are available
•
•
–
–
–
–
–
–
•
Step 1
--ip=IP1[/RANGE][,...]@VPN-NAME [--additive-mappings]
How to Add VPN-based Mappings
This option is supported to provide backwards compatibility with MPLS/VPN-based subscribers in releases before 3.1.5.
Options
The following options are available
•
•
•
Step 1
--vpn=VPN-NAME [--additive-mappings]
How to Configure the Community Parameter
An optional parameter may be set defining a community attribute. The community attribute provides a mechanism for defining the BGP community as one subscriber, using the community@VPN specification.
The community attribute in the BGP protocol is used to dynamically map IP ranges to subscribers. The community attribute can be configured in the Provider Edge (PE) router or in the Customer Edge (CE) router.
The community@VPN specification is replaced by an IP@VPN specification by the BGP LEG.
Use the p3subs utility to configure the community parameter.
Options
The following options are available:
•
•
–
–
–
Step 1
How to Remove VPN Mappings from Subscribers
•
•
•
•
To Remove All Existing Mappings from a Specified Subscriber
Step 1
To Remove a Specified IP Mapping from a Specified Subscriber
Step 1
To Remove a Specified VPN Mapping from a Specified Subscriber
Step 1
To Remove a Specified Community-based Mapping from a Specified Subscriber
Step 1
How to Monitor Subscriber MPLS/VPN Mappings
Use the p3subs utility to manage VPNs.
Step 1
6 Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.
CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco Ironport, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco Stackpower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flip Video, Flip Video (Design), Flipshare (Design), Flip Ultra, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Store, and Flip Gift Card are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0907R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2009 Cisco Systems, Inc. All rights reserved.
Feedback