Assigning an ID Number to a VPN
You can identify virtual private networks (VPNs) by a VPN identification number, as described in RFC 2685. This implementation of the VPN ID feature is used for identifying a VPN.
Finding Feature Information in This Module
Your Cisco IOS software release may not support all features. To find information about feature support and configuration, use the "Feature Information for Assigning an ID Number to a VPN" section.
Contents
•Information About VPN ID
•How to Configure a VPN ID
•Additional References
•Feature Information for Assigning an ID Number to a VPN
Information About VPN ID
Before configuring this feature, you should understand the following concepts:
•Introduction to VPN ID
•Components of the VPN ID
•Management Applications That Use VPN IDs
Introduction to VPN ID
You can identify VPNs by a VPN identification number, as described in RFC 2685. This implementation of the VPN ID feature is used for identifying a VPN. The VPN ID feature is not used to control the distribution of routing information or to associate IP addresses with VPN ID numbers in the MP-BGP VPNv4 routing updates.
Multiple VPNs can be configured in a router. A VPN is private and uses a private address space that might also be used by another VPN or by the Internet. The IP address used in a VPN is only significant to the VPN in which it exists. You can use a VPN name (a unique ASCII string) to reference a specific VPN configured in the router. Alternately, you can use a VPN ID to identify a particular VPN in the router. The VPN ID follows a standard specification (RFC 2685). To ensure that the VPN has a consistent VPN ID, assign the same VPN ID to all the routers in the service provider network that services that VPN.
Note Configuration of a VPN ID for a VPN is optional. You can still use a VPN name to identify configured VPNs in the router. The VPN name is not affected by the VPN ID configuration. These are two independent mechanisms to identify VPNs.
Components of the VPN ID
Each VPN ID defined by RFC 2685 consists of the following elements:
•An Organizational Unique Identifier (OUI), a three-octet hex number
The IEEE Registration Authority assigns OUIs to any company that manufactures components under the ISO/IEC 8802 standard. The OUI is used to generate universal LAN MAC addresses and protocol identifiers for use in local and metropolitan area network applications. For example, an OUI for Cisco Systems is 00-03-6B (hex).
•A VPN index, a four-octet hex number, which identifies the VPN within the company.
Use the following vpn id command and specify the VPN ID:
vpn id oui:vpn-index
A colon separates the OUI from the VPN index.
Management Applications That Use VPN IDs
You can use several applications to manage VPNs by VPN ID. Remote access applications, such as the Remote Authentication Dial-In User Service (RADIUS) and Dynamic Host Configuration Protocol (DHCP), can use the VPN ID feature to identify a VPN. RADIUS can use the VPN ID to assign dial-in users to the proper VPN, based on each user's authentication information.
Dynamic Host Configuration Protocol
Using DHCP network administrators can centrally manage and automate the assignment of IP addresses in an organization's network. The DHCP application uses the VPN ID as follows:
1. A VPN DHCP client requests a connection to a provider edge (PE) router from a VRF interface.
2. The PE router determines the VPN ID associated with that interface.
3. The PE router sends a request with the VPN ID and other information for assigning an IP address to the DHCP server.
4. The DHCP server uses the VPN ID and IP address information to process the request.
5. The DHCP server sends a response back to the PE router, allowing the VPN DHCP client access to the VPN.
Remote Authentication Dial-In User Service
A RADIUS server (or daemon) provides authentication and accounting services to one or more client network access servers (NASs). RADIUS servers authenticate users and return all configuration information necessary for the client to deliver service to the users.
Typically, a user login consists of a query (Access-Request) from the NAS to the RADIUS server and a corresponding response (Access-Accept or Access-Reject) from the server.
•The Access-Request packet contains the username, encrypted password, NAS IP address, VPN ID, and port. The format of the request also provides information on the type of session that the user wants to initiate.
•The RADIUS server returns an Access-Accept response if it finds the username and verifies the password. The response includes a list of attribute-value pairs that describe the parameters to be used for this session. If the user is not authenticated, an Access-Reject is sent by the RADIUS server and access is denied.
How to Configure a VPN ID
This section contains the following procedures:
•Specifying a VPN ID (required)
•Verifying the VPN ID Configuration (optional)
Specifying a VPN ID
Use this procedure to specify a VPN ID.
Restrictions
The VPN ID feature is not used to control the distribution of routing information or to associate IP addresses with VPN ID numbers in the MP-BGP VPNv4 routing updates.
Prerequisites
Each VRF configured on a PE router can have a VPN ID configured. Configure all the PE routers that belong to the same VPN with the same VPN ID. Make sure the VPN ID is unique to the service provider network.
SUMMARY STEPS
1. enable
2. configure terminal
3. ip vrf vrf-name
4. vpn id oui:vpn-index
DETAILED STEPS
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
configure terminal
Router# configure terminal |
Enters global configuration mode. |
Step 3 |
ip vrf vrf-name
Router(config)# ip vrf storm |
Creates a VRF routing table and a CEF forwarding table and enters VRF configuration mode. •vrf-name—Name assigned to a VRF. |
Step 4 |
vpn id oui:vpn-index
Router(config-vrf)# vpn id a1:3f6c |
Assigns the VPN ID to the VRF. •oui:—An organizationally unique identifier. The IEEE organization assigns this identifier to companies. The OUI is restricted to three octets. •vpn-index—This value identifies the VPN within the company. This VPN index is restricted to four octets. |
Example
The following example updates the VPN ID assigned to the VRF table called vpn1:
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# ip vrf vpn1
Router(config-vrf)# vpn id a1:3f6c
Verifying the VPN ID Configuration
To verify the VPN ID configuration, perform the following steps.
SUMMARY STEPS
1. show ip vrf
2. show ip vrf id
3. show ip vrf detail
DETAILED STEPS
Step 1 show ip vrf
Use this command to display information about the VRF tables on the PE router. This example displays three VRF tables called vpn1, vpn2, and vpn5.
Name Default RD Interfaces
Step 2 show ip vrf id
Use this command to ensure that the PE router contains the VPN ID you specified. The following example shows that only VRF tables vpn1 and vpn2 have VPN IDs assigned. The VRF table called vpn5 is not displayed, because it does not have a VPN ID.
Step 3 show ip vrf detail
Use this command to see all the VRFs on a PE router. This command displays all the VPN IDs that are configured on the router, their associated VRF names, and VRF route distinguishers (RDs). If a VRF table in the PE router has not been assigned a VPN ID, that VRF entry is not included in the output.
Router# show ip vrf detail
VRF vpn1; default RD 100:1; default VPNID A1:3F6C
Connected addresses are not in global routing table
Export VPN route-target communities
Import VPN route-target communities
VRF vpn2; default RD <not set>; default VPNID 2:3
Connected addresses are not in global routing table
No Export VPN route-target communities
No Import VPN route-target communities
VRF vpn5; default RD 500:1; default VPNID <not set>
Additional References
The following sections provide references related to MPLS VPNs.
Related Documents
Standards
|
|
IEEE Std 802-1990 |
IEEE Local and Metropolitan Area Networks: Overview and Architecture |
MIBs
|
|
None |
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs |
RFCs
|
|
RFC 2685 |
Virtual Private Networks Identifier |
Technical Assistance
|
|
The Cisco Technical Support website contains thousands of pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content. |
http://www.cisco.com/techsupport |
Feature Information for Assigning an ID Number to a VPN
Table 1 lists the features in this module and provides links to specific configuration information.
Not all commands may be available in your Cisco IOS software release. For details on when support for specific commands was introduced, see the command reference documents.
Cisco IOS software images are specific to a Cisco IOS software release, a feature set, and a platform. Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Note Table 1 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.
Table 1 Feature Information for Assigning an ID Number to a VPN
|
|
Feature Configuration Information
|
VPN ID |
12.0(17)ST 12.2(4)B 12.2(8)T 12.2(14)S |
This feature lets you you identify VPNs by a VPN identification number, as described in RFC 2685. The following sections provide information about this feature: •Components of the VPN ID •Management Applications That Use VPN IDs •How to Configure a VPN ID |
MPLS VPN ID |
Cisco IOS |
For information about feature support in Cisco IOS software, use Cisco Feature Navigator. |
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2007 Cisco Systems, Inc. All rights reserved.