Downloads |
Table Of Contents
Dialer Map VRF-Aware for an MPLS VPN
Supported Standards, MIBs, and RFCs
Configuring Dialer Map VRF-Aware for an MPLS VPN
Verifying Dialer Map VRF-Aware for an MPLS VPN
Monitoring and Maintaining Dialer Map VRF-Aware for an MPLS VPN
Dialer Map VRF-Aware for an MPLS VPN
Feature History
This document describes the Dialer Map VRF-Aware for an MPLS VPN feature in Cisco IOS
Release 12.2(8)T and includes the following sections:•
Supported Standards, MIBs, and RFCs
Feature Overview
The dialer software in Cisco IOS prior to Release 12.2(8)T had no way to dial two different destinations with the same IP address. More specifically, in networks where a network access server (NAS) supports dialing clients with overlapping addresses, dial-out attempts would fail. The Dialer Map VRF-Aware for an MPLS VPN feature solves this problem.
A VRF—virtual routing and forwarding instance—is a per-Virtual Private Network (VPN) routing information repository that defines the VPN membership of a customer site attached to the NAS. A VRF consists of an IP routing table, a derived Cisco Express Forwarding (CEF) table, a set of interfaces that use the forwarding table, and a set of rules and routing protocol parameters that control the information that is included in the routing table. A separate set of routing and CEF tables is maintained for each VPN customer.
The Multiprotocol Label Switching (MPLS) distribution protocol is a high-performance packet forwarding technology that integrates the performance and traffic management capabilities of data link layer switching with the scalability, flexibility, and performance of network-layer routing.
The Cisco IOS dialer software is "VRF-aware for an MPLS VPN," which means that it can distinguish between two destinations with the same IP address using information stored in the VRF. This capability is provided to the dialer software by two existing Cisco IOS commands, dialer map and ip route, which have been enhanced to include VRF information.
In previous Cisco IOS releases, the dialer software obtained the telephone number for dial-out based on the destination IP address configured in the dialer map command. Now, the enhanced dialer map command supplies the name of the VRF so that the telephone number to be dialed is based on the VRF name and the destination IP address. The VRF is identified based on the incoming interface of the packet, and is used with the destination IP address defined in the dialer map command to determine the telephone number to be dialed.
The ip route configuration command also includes the VRF information. When a packet arrives in an incoming interface that belongs to a particular VRF, only those ip route commands that correspond to that particular VRF are used to determine the destination interface.
Benefits
The Dialer Map VRF-Aware for an MPLS VPN feature allows the dialer software to dial out in an MPLS-based VPN. The MPLS VPN model simplifies network routing. For example, rather than needing to manage routing over a complex virtual network backbone composed of many virtual circuits, an MPLS VPN user can employ the backbone of the service provider as the default route in communicating with all other VPN sites.
This default route capability allows several sites to transparently interconnect through the service provider network. One service provider network can support several different IP VPNs, each of which appears to its users as a separate, private network. Within a VPN, each site can send IP packets to any other site in the same VPN, because each VPN is associated with one or more VRFs. The VRF is a key element in the VPN technology, because it maintains the routing information that defines a customer VPN site.
For additional benefits and information about MPLS, VPNs, and VRF, refer to the documents listed in the "Related Documents" section.
Related Documents
Additional information about configuring networks that can take advantage of the Dialer Map VRF-Aware for an MPLS VPN feature can be found in the following Cisco IOS documentation:
•
•
•
•
Supported Platforms
The Dialer Map VRF-Aware for an MPLS VPN feature is supported on the following Cisco router and access server platforms:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Determining Platform Support Through Feature Navigator
Cisco IOS software is packaged in feature sets that support specific platforms. To get updated information regarding platform support for this feature, access Feature Navigator. Feature Navigator dynamically updates the list of supported platforms as new platform support is added for the feature.
Feature Navigator is a web-based tool that enables you to quickly determine which Cisco IOS software images support a specific set of features and which features are supported in a specific Cisco IOS image.
Feature Navigator is updated regularly when major Cisco IOS software releases and technology releases occur. For the most current information, go to the Feature Navigator home page at the following URL:
Supported Standards, MIBs, and RFCs
Standards
None
MIBs
None
To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at the following URL:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
RFCs
None
Prerequisites
Before beginning the tasks described in this document, you need to understand how to configure the following network features:
•
•
Refer to the documents listed in the "Related Documents" section for information about configuring these features.
Configuration Tasks
See the following sections for the configuration tasks for this feature. Each task in the list is identified as either required or optional.
•
•
Configuring Dialer Map VRF-Aware for an MPLS VPN
To map a VRF and next hop address combination to a dial string and thereby allow the dialer software to be VRF-aware for an MPLS VPN, use the following commands beginning in global configuration mode.
These commands are only part of the required configuration and show how to map a VRF and next hop address combination to a dial string. Refer to the documents listed in the section "Related Documents" and the example in the "Configuration Example" section, for details on where to include these commands in the network configuration.
Verifying Dialer Map VRF-Aware for an MPLS VPN
The verification process described in this section is based on the following configuration:
interface dialer 1dialer map ip 10.0.0.1 vrf blue name peer1 peer1_numberip route vrf blue 10.0.0.1 255.255.255.255 Dialer0To verify correct operation of the Dialer Map VRF-Aware for an MPLS VPN feature, on the customer edge NAS, use the ping command in EXEC mode to place a call to peer. The expected result is that the NAS successfully dials out to peer1. If the call fails, use the show adjacency EXEC command to check CEF adjacency table information.
Troubleshooting Tips
If you encounter problems with the Dialer Map VRF-Aware for an MPLS VPN feature, use the following debug privileged EXEC commands on the NAS to help you determine where the problem lies:
•
•
•
•
•
•
Monitoring and Maintaining Dialer Map VRF-Aware for an MPLS VPN
To monitor and maintain the Dialer Map VRF-Aware for an MPLS VPN feature, use the following EXEC commands:
Configuration Example
This section provides a configuration example of the Dialer Map VRF-Aware for an MPLS VPN feature on the simple network topology shown in Figure 1.
Figure 1 CE-to-PE-to-Peer MPLS VPN Topology
Note
Customer Edge (CE) Router
!hostname oaktree02enable secret 5 !1!35Fg$Ep4.D8JGpg7rKxQa49BF9/!!ip subnet-zerono ip domain-lookup!!controller T1 5/0!controller T1 5/1!!!interface FastEthernet0/0no ip addressno ip mroute-cacheduplex autospeed auto!interface FastEthernet0/1no ip addressno ip mroute-cacheshutdownduplex autospeed auto!interface Ethernet1/0ip address 10.0.58.11 255.255.255.0no ip mroute-cachehalf-duplex!interface Ethernet1/1ip address 50.0.0.2 255.0.0.0no ip mroute-cachehalf-duplex!interface Ethernet1/2no ip addressno ip mroute-cacheshutdownhalf-duplex!interface Ethernet1/3no ip addressno ip mroute-cacheshutdownhalf-duplex!interface Serial2/0no ip addressno ip mroute-cacheshutdownno fair-queueserial restart-delay 0!interface Serial2/1no ip addressno ip mroute-cacheshutdownserial restart-delay 0!interface Serial2/2no ip addressno ip mroute-cacheshutdownserial restart-delay 0!interface Serial2/3no ip addressno ip mroute-cacheshutdownserial restart-delay 0!interface Serial3/0no ip addressno ip mroute-cacheshutdown!interface Serial3/1no ip addressno ip mroute-cacheshutdown!interface Serial3/2no ip addressno ip mroute-cacheshutdown!interface Serial3/3no ip addressno ip mroute-cacheshutdown!interface Serial3/4no ip addressno ip mroute-cacheshutdown!interface Serial3/5no ip addressno ip mroute-cacheshutdown!interface Serial3/6no ip addressno ip mroute-cacheshutdown!interface Serial3/7no ip addressno ip mroute-cacheshutdown!interface FastEthernet4/0no ip addressno ip mroute-cacheshutdownduplex autospeed auto!ip classlessip route 0.0.0.0 0.0.0.0 10.0.58.1ip route 60.0.0.0 255.0.0.0 50.0.0.1no ip http server!!snmp-server managerbanner motd ^C AV-8B OAKTREE^Calias exec r sh run!line con 0exec-timeout 0 0line aux 0loginline vty 0 4no login!endProvider's Edge (PE) Router
!hostname pinetree02!aaa new-model!!aaa authentication login con-log noneaaa authentication ppp default group radiusaaa authorization network default group radiusaaa session-id commonenable secret 5 $1$7KlA$xpC8l4dJCZogbzZvGUtFl/!username rubbertree02 password 0 Helloip subnet-zero!!no ip domain-lookup!!ip vrf yellowrd 100:1ip cefvirtual-profile aaaisdn switch-type primary-5ess!!!controller T1 3/0framing esflinecode b8zspri-group timeslots 1-24!controller T1 3/1framing esflinecode b8zs!controller T1 3/2framing esflinecode b8zs!controller T1 3/3framing esflinecode b8zs!controller T1 3/4framing esflinecode b8zs!controller T1 3/5framing esflinecode b8zs!controller T1 3/6framing esflinecode b8zs!controller T1 3/7framing esflinecode b8zs!!interface Loopback0ip vrf forwarding yellowip address 70.0.0.1 255.0.0.0!interface FastEthernet1/0no ip addressshutdownduplex half!interface Ethernet2/0ip address 10.0.58.3 255.255.255.0duplex full!interface Ethernet2/1ip vrf forwarding yellowip address 50.0.0.1 255.0.0.0duplex half!interface Ethernet2/2no ip addressshutdownduplex half!interface Ethernet2/3no ip addressshutdownduplex half!interface Serial3/0:23description phone# 555-3123no ip addressencapsulation pppdialer rotary-group 0dialer-group 1isdn switch-type primary-5essppp authentication chap!interface Serial4/0no ip addressshutdownno fair-queue!interface Serial4/1no ip addressshutdown!interface Serial4/2no ip addressshutdown!interface Serial4/3no ip addressshutdown!interface Dialer0ip address negotiatedencapsulation pppdialer in-banddialer map ip 60.0.0.12 vrf yellow name rubbertree02 5552171dialer map ip 60.0.0.2 5552172dialer-group 1ppp authentication chap!ip classlessip route 0.0.0.0 0.0.0.0 10.0.58.1ip route 60.0.0.2 255.255.255.255 Dialer0ip route vrf yellow 60.0.0.0 255.0.0.0 Dialer0 permanentno ip http serverip pim bidir-enable!ip director cache time 60dialer-list 1 protocol ip permit!!!radius-server host 172.19.192.89 auth-port 1645 acct-port 1646 key rad123radius-server retransmit 3call rsvp-sync!no mgcp timer receive-rtcp!mgcp profile default!dial-peer cor custom!!!gatekeepershutdown!banner motd ^C F/A-18 PINETREE ^C!line con 0exec-timeout 0 0login authentication con-logline aux 0line vty 5 15!!endPeer Router
!hostname rubbertree02!logging buffered 32000 debuggingenable secret 5 $1$RCKC$scgtdlaDzjSyUVAi7KK5Q.enable password Windy!username pinetree02 password 0 Hello!!!ip subnet-zerono ip domain-lookup!isdn switch-type basic-5ess!!!interface Ethernet0ip address 10.0.58.9 255.255.255.0no ip route-cache!interface Serial0no ip addressno ip route-cacheshutdown!interface BRI0description phone# 555-2171ip address 60.0.0.12 255.0.0.0encapsulation pppno ip route-cachedialer map ip 60.0.0.11 5553123dialer map ip 60.0.0.2 5552172dialer-group 1isdn switch-type basic-5essisdn fast-rollover-delay 45!ip default-gateway 10.0.58.1ip classlessip route 0.0.0.0 0.0.0.0 10.0.58.1ip route 50.0.0.0 255.0.0.0 70.0.0.1no ip http server!dialer-list 1 protocol ip permitno cdp runbanner motd ^C F-4B RUBBERTREE^C!line con 0exec-timeout 0 0line vty 0 4password Windylogin!endAAA Server User File
[aaa-serv]/usr/testing/bin> ./radiusd_1.16 -d . -a . -xgreentree-16 Password = "Hello", Expiration = "Dec 31 2005"Service-Type = Framed-User,Framed-Protocol = PPPcisco-avpair = "lcp:interface-config=ip vrf forwarding yellow \nipunnumbered Loopback0"Command Reference
This section documents the modified dialer map command. All other commands used with this feature are documented in the Cisco IOS Release 12.2 command reference publications.
dialer map
To configure a serial or ISDN interface to call multiple sites or to receive calls from multiple sites, use the dialer map command in interface configuration mode. Several options for using this command are possible; see the following description and the "Examples" section. To delete a particular dialer map entry, use the no form of this command.
Complete Syntax
dialer map protocol-keyword protocol-next-hop-address [broadcast | class dialer-map-class-name | modem-script modem-regexp | vrf vrf-name | name host-name | spc | speed 56 | speed 64 | system-script system-regular-expression | dial-string[:isdn-subaddress]]
no dialer map protocol-keyword protocol-next-hop-address [broadcast | class dialer-map-class-name | modem-script modem-regexp | vrf vrf-name | name host-name | spc | speed 56 | speed 64 | system-script system-regular-expression | dial-string[:isdn-subaddress]]
Dialer Map for an Asynchronous Interface
To configure an asynchronous interface to place a call to a single site that requires a system script or that has no assigned modem script, or to multiple sites on a single line, on multiple lines, or on a dialer rotary group, use the following form of the dialer map interface configuration command:
dialer map protocol-keyword protocol-next-hop-address [name host-name] [broadcast] [modem-script modem-regular-expression] [system-script system-regular-expression] [dial-string]
no dialer map protocol-keyword protocol-next-hop-address [name host-name] [broadcast] [modem-script modem-regular-expression] [system-script system-regular-expression] [dial-string]
Dialer Map for ISDN Interface and ISDN AOC Short-Hold Idle Timeout
To configure an ISDN interface to place a call to multiple sites, to authenticate calls from multiple sites, and to identify the class name that configures the ISDN Advice of Charge (AOC) short-hold idle timeout, use the following form of the dialer map interface configuration command:
dialer map protocol-keyword protocol-next-hop-address [name host-name] [speed 56 | speed 64] [broadcast] class class-name [dial-string[:isdn-subaddress]]
no dialer map protocol-keyword protocol-next-hop-address [name host-name] [speed 56 | speed 64] [broadcast] class class-name [dial-string[:isdn-subaddress]]
Dialer Map for German and Australian SPC
The following command syntax is used only in Germany for circuits between an ISDN BRI and a 1TR6 ISDN switch, and in Australia for circuits between an ISDN PRI and a TS-014 switch. To set up network addressing on an ISDN BRI interface to support semipermanent connection between customer equipment and the exchange, use the following form of the dialer map interface configuration command:
dialer map protocol-keyword protocol-next-hop-address [name host-name] [spc] [speed 56 | speed 64] [broadcast] dial-string[:isdn-subaddress]
no dialer map protocol-keyword protocol-next-hop-address [name host-name] [spc] [speed 56 | speed 64] [broadcast] dial-string[:isdn-subaddress]
Dialer Map for MPLS VPN
To configure a serial or ISDN interface to support an IP-based VPN routing and forwarding instance (VFR)-aware dialer map for a Multiprotocol Label Switching Virtual Private Network (MPLS VPN), use the following form of the dialer map interface configuration command:
dialer map ip protocol-next-hop-address vrf vrf-name name host-name dial-string
no dialer map ip protocol-next-hop-address vrf vrf-name name host-name dial-string
Dialer Map for Bridging
To configure a serial or ISDN interface to support bridging, use the following form of the dialer map interface configuration command:
dialer map bridge [name host-name] [broadcast] [dial-string[:isdn-subaddress]]
no dialer map bridge [name host-name] [broadcast] [dial-string[:isdn-subaddress]]
Syntax Description
Defaults
No dialer map is configured. The default speed is 64 kbps. No scripts are defined for placing calls.
Command Modes
Interface configuration
Command History
Usage Guidelines
Usage Guidelines for Asynchronous Interfaces
Configure a dialer map command for each remote destination for an asynchronous interface. Specify chat scripts for a physical interface that is not part of a dialer rotary group when no chat script is specified for the line, or when a system chat script is required to log on to the remote system. However, you need not specify a system script under the following conditions:
•
•
If you adhere to the chat script naming convention suggested in the description of the chat-script command, use the form modem-script *modulation-type in the dialer map command; for example, *-v32bis. This form allows you to specify the modulation type that is best for the system you are calling, and allows the modem type for the line to be specified by the script dialer command.
The period (.) is a wildcard that matches any character, and the asterisk (*) indicates that the preceding character can be duplicated multiple times. For more information about regular expressions, see the "Regular Expressions" appendix in the Cisco IOS Dial Technologies Configuration Guide, Release 12.2.
If a modem script is specified in the dialer map interface configuration command and a modem script specified in the script dialer line configuration command, the first chat script that matches both is used. If no script matches both, an error message is logged and the connection is not established. If there is no modem chat script specified for the line, the first chat script (that is, the one specified in the chat-script global configuration command) that matches the modem script's regular expression is used. If there is a system script specified in the dialer map interface configuration command, the first chat script to match the regular expression is used.
The modem-script and system-script keywords and corresponding arguments are optional. They are ignored on synchronous interfaces.
If you have named your chat script according to the type of modem and modulation (for example, codex-v32 or telebit v32), your regular expression could be codex-.* in the script dialer line configuration command, and *-v32bis in the modem script specified in the dialer map command for a system to which you want to connect to using V.32bis modulation.
The modem lines (specified by the argument regular-expression in the script dialer line configuration command) would be set to one of the following regular expressions to match patterns, depending on the kind of modem you have:
•
•
•
Usage Guidelines for Synchronous Interfaces
Use the dialer map command with the name keyword but without the dial-string in configurations in which remote sites are calling a central site, but the central site is not calling the remote site. With this command, the local device will authenticate the remote site using Challenge Handshake Authentication Protocol (CHAP) or Password Authentication Protocol (PAP), which will transmit the remote site's host name to the central site. The central site will then use this name to authenticate the caller, and will use the next hop address to send packets to the remote site. Because there is no dialer string specified, the central site cannot call the remote router.
Usage Guidelines for ISDN Interfaces and ISDN AOC
Use the dialer map command with the name keyword in configurations in which remote sites are calling a central site, but the central site is not calling the remote site. With this command, the local device will authenticate the remote site using CHAP or PAP, which will send the remote site host name to the central site. The central site will then use this name to authenticate the caller, and will use the next hop address to send packets to the remote site. Because no dialer string is specified, the central site cannot call the remote router.
For ISDN interfaces only, you can specify an optional speed parameter for dialer map commands if you also specify a dial string. This option informs the ISDN software whether it should place a call at 56 or 64 kbps. If you omit the ISDN speed parameter, the default is 64 kbps.
For routers with ISDN interfaces, if calling line identification (CLI)—also known as caller ID and ANI—is provided, the host-name field may contain the number that calling line ID provides.
When the network provides ISDN AOC information, use the dialer map command with the class keyword for outgoing calls . Use the map-class dialer global command to identify the class name, the dialer idle-timeout command to define a static idle timeout period for outgoing calls to the class, and the dialer isdn short-hold command to define the minimum idle time to wait before disconnecting calls at the end of the charging period.
Usage Guidelines for MPLS VPN
Beginning with Cisco IOS Release 12.2(8)T, dialer software became capable of being "VRF aware for MPLS-VPN," meaning that it can distinguish between two destinations with the same IP address using information stored in a VRF. When the dialer map command is configured with the vrf keyword in an MPLS VPN, the dialer software looks up a map for the next hop address using the next hop address and the VRF name configured. Once dial-out takes place and authentication is complete, a virtual profile interface is created. The VRF is installed on the virtual profile interface using the following per-user AAA interface command:
cisco-avpair "lcp:interface-config=ip vrf forwarding vrf-name"Data transfer occurs as defined by the virtual profile dialer. When an IP route for a particular VRF points to the dialer (configured using the ip route global configuration command), the dialer uses the VFR-aware dialer map to get the dial string and IP address, and to bring up the connection. Once the user is authenticated, a virtual access interface is created and the user details are downloaded from the AAA server, and finally, the appropriate IP VRF command is applied on the virtual access interface.
Examples
Asynchronous Interface Examples
The following example sets the dialer speed at 56 kbps to call a remote site at 172.19.2.5:
interface async 1encapsulation pppppp authentication chapdialer map ip 172.19.2.5 speed 56The following example shows a dialing chat script and a login chat script. The dialer in-band command enables dial-on-demand routing (DDR) on asynchronous interface 10, and the dialer map command looks for the specified dialing and the login scripts, then uses those scripts to dial the string 95557890.
chat-script dial ABORT ERROR "" "AT Z" OK "ATDT \T" TIMEOUT 30 CONNECT \cchat-script login ABORT invalid TIMEOUT 15 name: billw word: wewpass ">" "slip default"interface async 10dialer in-banddialer map ip 10.55.0.1 modem-script dial system-script login 95557890In the following example, the remote site is calling the central site, and the central site is calling the remote site. The central router uses the name ZZZ to authenticate the remote router when connection is made, and uses the dialer string 14155553434 to call the remote router if it is not currently connected.
interface async 1dialer map ip 172.19.2.5 name ZZZ 14155553434In the following example, a remote site is calling a central site, but the central site is not calling the remote site. The local device will authenticate the site that is calling in using CHAP. CHAP causes the remote site name, YYY, to be sent to the site it is calling. The central site will then use this name to authenticate the remote site.
interface async 1encapsulation pppppp authentication chapdialer map ip 172.19.2.5 name YYYISDN AOC Short-Hold Idle Timeout Example
In the following legacy DDR example, a BRI interface is configured with dialer map classes to use for outgoing calls, and a dialer idle timeout period to use for all incoming calls. All of the map classes are configured with dialer idle timeout periods that override the interface static dialer idle timeout for outgoing calls. Two map classes are also configured for an ISDN AOC short-hold idle timeout.
hostname A!username IA password 7 1533121F0725username IB password 7 110A1016262D29username IC password 7 1533121F072508isdn switch-type basic-net3!interface bri 0ip address 10.0.0.35 255.0.0.0encapsulation pppdialer idle-timeout 150dialer map ip 10.0.0.33 name IA class Rex 06966600050dialer map ip 10.0.0.40 name IB class Bubba 778578dialer map ip 10.0.0.45 name IC class Scout 778579ppp authentication chap!map-class dialer Scoutdialer idle-timeout 300dialer isdn short-hold 10!map-class dialer Rexdialer idle-timeout 300!map-class dialer Bubbadialer idle-timeout 300dialer isdn short-hold 10SPC Example
The following example configures the interface for semipermanent connections in Germany; the IP address and the phone number are provided.
dialer map ip 192.168.48.2 spc 49305555655:3789MPLS VPN Example
virtual-profile virtual-template 1virtual-profile aaa!interface virtual-template 1ip unnumbered loopback0ppp authentication chapppp multilink...interface dialer 1dialer map ip 10.9.9.9 vrf green_vrf name green_name 5552345dialer map ip 10.9.9.9 vrf yellow_vrf name yellow_name 5553456ppp authentication chapppp multilink...ip route vrf vrfgreen_vrf 10.9.9.9 255.255.255.255 dialer1ip route vrf vrfyellow_vrf 10.9.9.9 255.255.255.255 dialer1Related Commands
