The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The MPLS LDP Inbound Label Binding Filtering feature supports inbound label binding filtering. You can use the Multiprotocol Label Switching (MPLS) Label Distribution Protocol (LDP) feature to configure access control lists (ACLs) for controlling the label bindings a label switch router (LSR) accepts from its peer LSRs.
For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for MPLS LDP Inbound Label Binding Filtering" section.
Use Cisco Feature Navigator to find information about platform support and Cisco IOS XE software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
•Restrictions for MPLS LDP Inbound Label Binding Filtering
•Information about MPLS LDP Inbound Label Binding Filtering
•How to Configure MPLS LDP Inbound Label Binding Filtering
•Configuration Examples for MPLS LDP Inbound Label Binding Filtering
•Feature Information for MPLS LDP Inbound Label Binding Filtering
Inbound label binding filtering does not support extended ACLs; it only supports standard ACLs.
Before you configure this feature, you should understand the following concept:
•MPLS LDP Inbound Label Binding Filtering Benefit
The MPLS LDP Inbound Label Binding Filtering feature may be used to control the amount of memory used to store LDP label bindings advertised by other routers. For example, in a simple MPLS Virtual Private Network (VPN) environment, the VPN provider edge (PE) routers may require LSPs only to their peer PE routers (that is, they do not need LSPs to core routers). Inbound label binding filtering enables a PE router to accept labels only from other PE routers.
This section includes the following tasks:
•Configuring MPLS LDP Inbound Label Binding Filtering (Required)
•Verifying that MPLS LDP Inbound Label Bindings are Filtered (Optional)
Perform this task to configure a router for inbound label filtering.
The following configuration allows the router to accept only the label for prefix 192.168.1.1 from LDP neighbor router 10.12.12.12.
1. enable
2. configure terminal
3. ip access-list standard access-list-number
4. permit {source [source-wildcard] | any} [log]
5. exit
6. mpls ldp neighbor [vrf vpn-name] nbr-address labels accept acl
7. end
If inbound filtering is enabled, perform the following tasks to verify that inbound label bindings are filtered.
1. enable
2. show mpls ldp neighbor [vrf vpn-name] [address | interface] [detail]
3. show ip access-list [access-list-number | access-list-name]
4. show mpls ldp bindings
5. end
Step 1 enable
Use this command to enable privileged EXEC mode. Enter your password if prompted. For example:
Router> enable
Router#
Step 2 show mpls ldp neighbor [vrf vpn-name] [address | interface] [detail]
Enter the show mpls ldp neighbor command to show the status of the LDP session, including the name or number of the ACL configured for inbound filtering.
Note To display information about inbound label binding filtering, you must enter the detail keyword.
Router# show mpls ldp neighbor 10.12.12.12 detail
Peer LDP Ident: 10.12.12.12:0; Local LDP Ident 10.13.13.13:0
TCP connection: 10.12.12.12.646 - 10.13.13.13.12592
State: Oper; Msgs sent/rcvd: 49/45; Downstream; Last TIB rev sent 1257
Up time: 00:32:41; UID: 1015; Peer Id 0;
LDP discovery sources:
Serial1/0/0; Src IP addr: 192.168.1.1
holdtime: 15000 ms, hello interval: 5000 ms
Addresses bound to peer LDP Ident:
10.0.0.129 10.12.12.12 192.168.1.1
Peer holdtime: 180000 ms; KA interval: 60000 ms; Peer state: estab
LDP inbound filtering accept acl: 1
Step 3 show ip access-list [access-list-number | access-list-name]
Enter the show ip access-list command to display the contents of all current IP access lists or of a specified access list.
Note It is important that you enter this command to see how the access list is defined; otherwise, you cannot verify inbound label binding filtering.
The following command output shows the contents of IP access list 1:
Router# show ip access 1
Standard IP access list 1
permit 10.0.0.0, wildcard bits 0.0.0.255 (1 match)
Step 4 show mpls ldp bindings
Enter the show mpls ldp bindings command to verify that the LSR has remote bindings only from a specified peer for prefixes permitted by the access list.
Router# show mpls ldp bindings
tib entry: 10.0.0.0/8, rev 4
local binding: tag: imp-null
tib entry: 10.2.0.0/16, rev 1137
local binding: tag: 16
tib entry: 10.2.0.0/16, rev 1139
local binding: tag: 17
tib entry: 10.12.12.12/32, rev 1257
local binding: tag: 18
tib entry: 10.13.13.13/32, rev 14
local binding: tag: imp-null
tib entry: 10.10.0.0/16, rev 711
local binding: tag: imp-null
tib entry: 10.0.0.0/8, rev 1135
local binding: tag: imp-null
remote binding: tsr: 10.12.12.12:0, tag: imp-null
tib entry: 10.0.0.0/8, rev 8
local binding: tag: imp-null
Step 5 exit
Use this command to exit to user EXEC mode. For example:
Router# exit
Router>
This section contains the following configuration example for MPLS LDP inbound label binding filtering:
•Configuring MPLS LDP Inbound Label Binding Filtering: Example
In the following example, the mpls ldp neighbor labels accept command is configured with an access control list to filter label bindings received on sessions with the neighbor 10.110.0.10.
Label bindings for prefixes that match 10.b.c.d are accepted, where b is less than or equal to 63, and c and d can be any integer between 0 and 128. Other label bindings received from 10.110.0.10 are rejected.
Router# configure terminal
Router(config)# access-list 1 permit 10.63.0.0 0.63.255.255
Router(config)# mpls ldp neighbor 10.110.0.10 labels accept 1
Router(config)# end
In the following example, the show mpls ldp bindings neighbor command displays label bindings that were learned from 10.110.0.10. This example verifies that the LIB does not contain label bindings for prefixes that have been excluded.
Router# show mpls ldp bindings neighbor 10.110.0.10
tib entry: 10.2.0.0/16, rev 4
remote binding: tsr: 10.110.0.10:0, tag: imp-null
tib entry: 10.43.0.0/16, rev 6
remote binding: tsr: 10.110.0.10:0, tag: 16
tib entry: 10.52.0.0/16, rev 8
remote binding: tsr: 10.110.0.10:0, tag: imp-null
The following sections provide additional references related to MPLS LDP inbound label binding filters.
|
|
---|---|
Configuration information for MPLS LDP |
"MPLS Label Distribution Protocol (LDP)" chapter in the Cisco IOS XE Multiprotocol Label Switching Configuration Guide |
MPLS LDP commands |
|
|
---|---|
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. |
— |
|
|
---|---|
RFC 3036 |
|
RFC 3037 |
Table 1 lists the features in this module and provides links to specific configuration information.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS XE software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note Table 1 lists only the Cisco IOS XE software release that introduced support for a given feature in a given Cisco IOS XE software release train. Unless noted otherwise, subsequent releases of that Cisco IOS XE software release train also support that feature.
|
|
|
---|---|---|
MPLS LDP Inbound Label Binding Filtering |
Cisco IOS XE Release 2.1 |
The MPLS LDP Inbound Label Binding Filtering feature supports inbound label binding filtering. You can use the Multiprotocol Label Switching (MPLS) Label Distribution Protocol (LDP) feature to configure access control lists (ACLs) for controlling the label bindings a label switch router (LSR) accepts from its peer LSRs. In Cisco IOS XE Release 2.1, support was added for the Cisco ASR 1000 Series Aggregation Services Routers. The following sections provide information about this feature: •MPLS LDP Inbound Label Binding Filtering Benefit •Configuring MPLS LDP Inbound Label Binding Filtering •Verifying that MPLS LDP Inbound Label Bindings are Filtered The following commands were introduced or modified: clear mpls ldp neighbor, mpls ldp neighbor labels accept, show mpls ldp neighbor. |
CE router—customer edge router. A router that is part of a customer network and that interfaces to a provider edge (PE) router.
inbound label binding filtering—Allows LSRs to control which label bindings it will accept from its neighboring LSRs. Consequently, an LSR does not accept or store some label bindings that its neighbors advertise.
label—A short fixed-length identifier that tells switching nodes how to forward data (packets or cells).
label binding—An association between a destination prefix and a label.