Table Of Contents
Configuring NSF/SSO—MPLS VPN
First Published: August 11, 2004Last Updated: November 22, 2010
The NSF/SSO—MPLS VPN feature allows a provider edge (PE) router to preserve data forwarding information in a Multiprotocol Label Switching (MPLS) Virtual Private Network (VPN) when the primary Route Processor (RP) restarts. This module describes how to enable nonstop forwarding (NSF) in a basic MPLS VPN network.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for NSF/SSO—MPLS VPN" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for NSF/SSO—MPLS VPN
•You must have a supported MPLS VPN network configuration. See Configuring MPLS VPNs for more information.
•The networking device that is to be configured for NSF must first be configured for stateful switchover (SSO). See Stateful Switchover for more information
•You must enable NSF on the routing protocols running between the provider (P) routers, provider edge (PE) routers, and customer edge (CE) routers. The supported routing protocols are Border Gateway Protocol (BGP), Open Shortest Path First (OSPF), and Intermediate System-to-Intermediate System (IS-IS). See Configuring Nonstop Forwarding for more information.
•You must configure Cisco NSF support on the routers for Cisco Express Forwarding. See Configuring Nonstop Forwarding for more information.
•All neighbor networking devices must be NSF-aware. Peer routers must support the graceful restart of the protocol used to communicate with the NSF/SSO—MPLS VPN-capable router.
Restrictions for NSF/SSO—MPLS VPN
•Tag Distribution Protocol (TDP) sessions are not supported. Only Label Distribution Protocol (LDP) sessions are supported.
•The NSF/SSO—MPLS VPN feature cannot be configured on label-controlled ATM (LC-ATM) interfaces.
Information About NSF/SSO—MPLS VPN
Elements That Enable NSF/SSO—MPLS VPN
VPN NSF requires several elements in order to work:
•VPN NSF uses the BGP Graceful Restart mechanisms to create MPLS forwarding entries for VPNv4 prefixes in NSF mode. The forwarding entries are preserved during a restart. BGP also saves prefix and corresponding label information and recovers the information after a restart.
•The NSF/SSO—MPLS VPN feature also uses NSF for the label distribution protocol in the core network (either MPLS Label Distribution Protocol, traffic engineering, or static labeling).
•The NSF/SSO—MPLS VPN feature uses NSF for the Interior Gateway Protocol (IGP) used in the core (OSPF or IS-IS).
•The NSF/SSO—MPLS VPN feature uses NSF for the routing protocols between the PE and CE routers.
How VPN Prefix Information Is Checkpointed to the Backup Route Processor
When BGP allocates local labels for prefixes, it checkpoints the local label binding in the backup RP. The checkpointing function copies state information from the active RP to the backup RP, thereby ensuring that the backup RP has an identical copy of the latest information. If the active RP fails, the backup RP can take over with no interruption in service. Checkpointing begins when the active RP does a bulk synchronization, which copies all of the local label bindings to the backup RP. After that, the active RP dynamically checkpoints individual prefix label bindings when a label is allocated or freed. This allows forwarding of labeled packets to continue before BGP reconverges.
How BGP Graceful Restart Preserves Prefix Information During a Restart
When a BGP Graceful Restart-capable router loses connectivity, it performs the following actions as the restarting router:
1. The restarting router establishes BGP sessions with other routers and relearns the BGP routes from other routers that are also capable of Graceful Restart. The restarting router waits to receive updates from the neighboring routers. When the neighboring routers send end-of-Routing Information Base (RIB) markers to indicate that they are done sending updates, the restarting router starts sending its own updates.
2. The restarting router accesses the checkpoint database to find the label that was assigned for each prefix. If it finds the label, it advertises it to the neighboring router. If it does not find the label, it allocates a new label and advertises it.
3. The restarting router removes any stale prefixes after a timer for stale entries expires.
A BGP Graceful Restart-capable peer router performs the following actions when it encounters a restarting router:
1. The peer router sends all the routing updates to the restarting router. When it has finished sending updates, the peer router sends an end-of-RIB marker to the restarting router.
2. The peer router does not immediately remove the BGP routes learned from the restarting router from its BGP routing table. As it learns the prefixes from the restarting router, the peer refreshes the stale routes if the new prefix and label information matches the old information.
If a router is not configured for the NSF/SSO—MPLS VPN feature and it attempts to establish a BGP session with a router that is configured with the NSF/SSO—MPLS VPN feature, the two routers create a normal BGP session but do not have the ability to perform the NSF/SSO—MPLS VPN feature.
How to Configure NSF/SSO—MPLS VPN
•Configuring NSF Support for Basic VPNs (required)
•Verifying the NSF/SSO—MPLS VPN Configuration (optional)
Configuring NSF Support for Basic VPNs
2. configure terminal
3. ip cef [distributed]
4. router bgp autonomous-system-number
5. bgp graceful-restart
6. bgp graceful-restart restart-time seconds
7. bgp graceful-restart stalepath-time seconds
Verifying the NSF/SSO—MPLS VPN Configuration
1. show ip bgp vpnv4 all labels
2. show ip bgp vpnv4 all neighbors
3. show ip bgp labels
4. show ip bgp neighbors
Step 1 show ip bgp vpnv4 all labels
This command displays incoming and outgoing BGP labels for each route distinguisher. The following is sample output from the command:Router# show ip bgp vpnv4 all labelsNetwork Next Hop In label/Out labelRoute Distinguisher: 100:1 (vpn1)10.3.0.0/16 10.0.0.5 25/2010.0.0.1 25/2310.0.0.2 25/imp-null10.0.0.9/32 10.0.0.1 24/2126.96.36.199 24/imp-null
Step 2 show ip bgp vpnv4 all neighbors
This command displays whether the BGP peers are capable of Graceful Restart. The following is sample output from the command:Router# show ip bgp vpnv4 all neighborsBGP neighbor is 10.0.0.1, remote AS 100, internal linkBGP version 4, remote router ID 10.0.0.1BGP state = Established, up for 02:49:47Last read 00:00:47, hold time is 180, keepalive interval is 60 secondsNeighbor capabilities:Route refresh: advertised and received(new)Address family VPNv4 Unicast: advertised and receivedGraceful Restart Capabilty: advertised and receivedRemote Restart timer is 120 secondsAddress families preserved by peer:VPNv4 Unicast...
Step 3 show ip bgp labels
This command displays information about MPLS labels in the Exterior Border Gateway Protocol (EBGP) route table. The following is sample output from the command:Router# show ip bgp labelsNetwork Next Hop In label/Out label10.3.0.0/16 10.0.0.1 imp-null/imp-null0.0.0.0 imp-null/nolabel10.0.0.9/32 10.0.0.1 21/2910.0.0.11/32 10.0.0.1 24/3810.0.0.13/32 0.0.0.0 imp-null/nolabel10.0.0.15/32 10.0.0.1 29/nolabel10.0.0.1 29/21
Step 4 show ip bgp neighbors
This command displays whether the BGP peers are capable of Graceful Restart. The following is sample output from the command:Router# show ip bgp neighborsBGP neighbor is 10.0.0.1, remote AS 100, external linkBGP version 4, remote router ID 10.0.0.5BGP state = Established, up for 02:54:19Last read 00:00:18, hold time is 180, keepalive interval is 60 secondsNeighbor capabilities:Route refresh: advertised and received(new)Address family IPv4 Unicast: advertised and receivedipv4 MPLS Label capability: advertised and receivedGraceful Restart Capabilty: advertised and receivedRemote Restart timer is 120 secondsAddress families preserved by peer:IPv4 Unicast...
Configuration Examples for NSF/SSO—MPLS VPN
Example: NSF/SSO—MPLS VPN for a Basic MPLS VPN
The following sample output shows the configuration of the NSF/SSO—MPLS VPN feature on the CE and PE routers. SSO is enabled by default, and LDP is the default MPLS label protocol.
CE1 Routerip cefno ip domain-lookup!interface Loopback0ip address 10.10.10.10 255.255.255.255!interface GigabitEthernet1/0/4ip address 10.0.0.1 255.0.0.0media-type 10BaseT!router ospf 100redistribute bgp 101nsf enforce globalpassive-interface GigabitEthernet1/0/4network 10.0.0.0 0.255.255.255 area 100!router bgp 101no synchronizationbgp graceful-restart restart-time 120bgp graceful-restart stalepath-time 360bgp graceful-restart network 10.0.0.0network 10.0.0.0neighbor 10.0.0.2 remote-as 100
PE1 Routerredundancymode sso!ip cef distributedmpls ldp graceful-restartmpls label protocol ldpip vrf vpn1rd 100:1route-target export 100:1route-target import 100:1no mpls aggregate-statistics!interface Loopback0ip address 10.12.12.12 255.255.255.255!interface GigabitEthernet1/0/4ip vrf forwarding vpn1ip address 10.0.0.2 255.0.0.0!mpls ipinterface ATM3/0/0no ip address!interface ATM3/0/0.1 point-to-pointip unnumbered Loopback0mpls ip!router ospf 100passive-interface GigabitEthernet1/0/4nsf enforce globalnetwork 10.0.0.0 0.255.255.255 area 100!router bgp 100no synchronizationbgp graceful-restart restart-time 120bgp graceful-restart stalepath-time 360bgp graceful-restartno bgp default ipv4-unicastneighbor 10.14.14.14 remote-as 100neighbor 10.14.14.14 update-source Loopback0!address-family ipv4 vrf vpn1neighbor 10.0.0.1 remote-as 101neighbor 10.0.0.1 activateexit-address-family!address-family vpnv4neighbor 10.14.14.14 activateneighbor 10.14.14.14 send-community extendedexit-address-family
PE2 Routerredundancymode sso!ip cef distributedmpls ldp graceful-restartmpls label protocol ldp!ip vrf vpn1rd 100:1route-target export 100:1route-target import 100:1no mpls aggregate-statistics!!interface Loopback0ip address 10.14.14.14 255.255.255.255!interface ATM1/0no ip address!interface ATM1/0.1 point-to-pointip unnumbered Loopback0mpls ip!interface FastEthernet3/0/0ip vrf forwarding vpn1ip address 10.0.0.1 255.0.0.0ip route-cache distributed!router ospf 100nsf enforce globalpassive-interface FastEthernet3/0/0network 10.0.0.0 0.255.255.255 area 100!router bgp 100no synchronizationbgp graceful-restart restart-time 120bgp graceful-restart stalepath-time 360bgp graceful-restartno bgp default ipv4-unicastneighbor 10.12.12.12 remote-as 100neighbor 10.12.12.12 update-source Loopback0!address-family ipv4 vrf vpn1neighbor 10.0.0.2 remote-as 102neighbor 10.0.0.2 activateexit-address-family!address-family vpnv4neighbor 10.12.12.12 activateneighbor 10.12.12.12 send-community extendedexit-address-family
CE2 Routerip cef!interface Loopback0ip address 10.13.13.13 255.255.255.255!interface FastEthernet0/1ip address 10.0.0.2 255.0.0.0no ip mroute-cache!router ospf 100redistribute bgp 102nsf enforce globalpassive-interface FastEthernet0/1network 10.0.0.0 0.255.255.255 area 100!router bgp 102no synchronizationbgp graceful-restart restart-time 120bgp graceful-restart stalepath-time 360bgp graceful-restartnetwork 10.0.0.0network 10.0.0.0neighbor 10.0.0.1 remote-as 100
Related Topic Document Title
Basic MPLS VPNs
"Part 4: MPLS Virtual Private Networks" module in the Cisco IOS XE Multiprotocol Label Switching Configuration Guide
Cisco IOS commands
Cisco IOS debug commands
Cisco IOS HA commands
Nonstop forwarding and BGP Graceful Restart
Nonstop forwarding for MPLS LDP
Graceful Restart Mechanism for BGP with MPLS
Graceful Restart Mechanism for BGP
MIB MIBs Link
MPLS VPN MIB
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
A Border Gateway Protocol
Application of the Border Gateway Protocol in the Internet
Multiprotocol Extensions for BGP-4
Feature Information for NSF/SSO—MPLS VPN
Table 1 lists the release history for this feature.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/fn. An account on Cisco.com is not required.
Note Table 1 lists only the software release that introduced support for a given feature in given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2004-2011 Cisco Systems, Inc. All rights reserved.