This documentation has been moved
Assigning an ID Number to a VPN
Download this chapter
Assigning an ID Number to a VPNAssigning an ID Number to a VPN
 Feedback

Table Of Contents

Assigning an ID Number to a VPN

Contents

Information About VPN ID

Introduction to VPN ID

Components of the VPN ID

Management Applications That Use VPN IDs

Dynamic Host Configuration Protocol

Remote Authentication Dial-In User Service

How to Configure a VPN ID

Specifying a VPN ID

Restrictions

Prerequisites

Verifying the VPN ID Configuration

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Feature Information for Assigning an ID Number to a VPN


Assigning an ID Number to a VPN

You can identify virtual private networks (VPNs) by a VPN identification number, as described in RFC 2685. This implementation of the VPN ID feature is used for identifying a VPN.

Finding Feature Information in This Module

Your Cisco IOS software release may not support all features. To find information about feature support and configuration, use the "Feature Information for Assigning an ID Number to a VPN" section.

Contents

•Information About VPN ID

•How to Configure a VPN ID

•Additional References

•Feature Information for Assigning an ID Number to a VPN

Information About VPN ID

Before configuring this feature, you should understand the following concepts:

•Introduction to VPN ID

•Components of the VPN ID

•Management Applications That Use VPN IDs

Introduction to VPN ID

You can identify VPNs by a VPN identification number, as described in RFC 2685. This implementation of the VPN ID feature is used for identifying a VPN. The VPN ID feature is not used to control the distribution of routing information or to associate IP addresses with VPN ID numbers in the MP-BGP VPNv4 routing updates.

Multiple VPNs can be configured in a router. A VPN is private and uses a private address space that might also be used by another VPN or by the Internet. The IP address used in a VPN is only significant to the VPN in which it exists. You can use a VPN name (a unique ASCII string) to reference a specific VPN configured in the router. Alternately, you can use a VPN ID to identify a particular VPN in the router. The VPN ID follows a standard specification (RFC 2685). To ensure that the VPN has a consistent VPN ID, assign the same VPN ID to all the routers in the service provider network that services that VPN.

Note Configuration of a VPN ID for a VPN is optional. You can still use a VPN name to identify configured VPNs in the router. The VPN name is not affected by the VPN ID configuration. These are two independent mechanisms to identify VPNs.

Components of the VPN ID

Each VPN ID defined by RFC 2685 consists of the following elements:

•An Organizational Unique Identifier (OUI), a three-octet hex number

The IEEE Registration Authority assigns OUIs to any company that manufactures components under the ISO/IEC 8802 standard. The OUI is used to generate universal LAN MAC addresses and protocol identifiers for use in local and metropolitan area network applications. For example, an OUI for Cisco Systems is 00-03-6B (hex).

•A VPN index, a four-octet hex number, which identifies the VPN within the company.

Use the following vpn id command and specify the VPN ID:

vpn id oui:vpn-index

A colon separates the OUI from the VPN index.

Management Applications That Use VPN IDs

You can use several applications to manage VPNs by VPN ID. Remote access applications, such as the Remote Authentication Dial-In User Service (RADIUS) and Dynamic Host Configuration Protocol (DHCP), can use the VPN ID feature to identify a VPN. RADIUS can use the VPN ID to assign dial-in users to the proper VPN, based on each user's authentication information.

Dynamic Host Configuration Protocol

Using DHCP network administrators can centrally manage and automate the assignment of IP addresses in an organization's network. The DHCP application uses the VPN ID as follows:

1. A VPN DHCP client requests a connection to a provider edge (PE) router from a VRF interface.

2. The PE router determines the VPN ID associated with that interface.

3. The PE router sends a request with the VPN ID and other information for assigning an IP address to the DHCP server.

4. The DHCP server uses the VPN ID and IP address information to process the request.

5. The DHCP server sends a response back to the PE router, allowing the VPN DHCP client access to the VPN.

Remote Authentication Dial-In User Service

A RADIUS server (or daemon) provides authentication and accounting services to one or more client network access servers (NASs). RADIUS servers authenticate users and return all configuration information necessary for the client to deliver service to the users.

Typically, a user login consists of a query (Access-Request) from the NAS to the RADIUS server and a corresponding response (Access-Accept or Access-Reject) from the server.

•The Access-Request packet contains the username, encrypted password, NAS IP address, VPN ID, and port. The format of the request also provides information on the type of session that the user wants to initiate.

•The RADIUS server returns an Access-Accept response if it finds the username and verifies the password. The response includes a list of attribute-value pairs that describe the parameters to be used for this session. If the user is not authenticated, an Access-Reject is sent by the RADIUS server and access is denied.

How to Configure a VPN ID

This section contains the following procedures:

•Specifying a VPN ID (required)

•Verifying the VPN ID Configuration (optional)

Specifying a VPN ID

Use this procedure to specify a VPN ID.

Restrictions

The VPN ID feature is not used to control the distribution of routing information or to associate IP addresses with VPN ID numbers in the MP-BGP VPNv4 routing updates.

Prerequisites

Each VRF configured on a PE router can have a VPN ID configured. Configure all the PE routers that belong to the same VPN with the same VPN ID. Make sure the VPN ID is unique to the service provider network.

SUMMARY STEPS

1. enable

2. configure terminal

3. ip vrf vrf-name

4. vpn id oui:vpn-index

DETAILED STEPS

 
Command
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

ip vrf vrf-name

Example:

Router(config)# ip vrf storm

Creates a VRF routing table and a CEF forwarding table and enters VRF configuration mode.

•vrf-name—Name assigned to a VRF.

Step 4 

vpn id oui:vpn-index

Example:

Router(config-vrf)# vpn id a1:3f6c

Assigns the VPN ID to the VRF.

•oui:—An organizationally unique identifier. The IEEE organization assigns this identifier to companies. The OUI is restricted to three octets.

•vpn-index—This value identifies the VPN within the company. This VPN index is restricted to four octets.

Example

The following example updates the VPN ID assigned to the VRF table called vpn1: 

Router# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Router(config)# ip vrf vpn1

Router(config-vrf)# vpn id a1:3f6c

Verifying the VPN ID Configuration

To verify the VPN ID configuration, perform the following steps.

SUMMARY STEPS

1. show ip vrf

2. show ip vrf id

3. show ip vrf detail

DETAILED STEPS

Step 1 show ip vrf

Use this command to display information about the VRF tables on the PE router. This example displays three VRF tables called vpn1, vpn2, and vpn5. 

Router# show ip vrf

  Name                             Default RD          Interfaces

  vpn1                             100:1               Ethernet1/1

                                                       Ethernet1/4

  vpn2                             <not set>

  vpn5                             500:1               Loopback2

Step 2 show ip vrf id

Use this command to ensure that the PE router contains the VPN ID you specified. The following example shows that only VRF tables vpn1 and vpn2 have VPN IDs assigned. The VRF table called vpn5 is not displayed, because it does not have a VPN ID. 

Router# show ip vrf id

VPN Id          Name                             RD

2:3             vpn2                             <not set>

A1:3F6C         vpn1                             100:1

Step 3 show ip vrf detail

Use this command to see all the VRFs on a PE router. This command displays all the VPN IDs that are configured on the router, their associated VRF names, and VRF route distinguishers (RDs). If a VRF table in the PE router has not been assigned a VPN ID, that VRF entry is not included in the output. 

Router# show ip vrf detail

VRF vpn1; default RD 100:1; default VPNID A1:3F6C

  Interfaces:

    Ethernet1/1              Ethernet1/4

  Connected addresses are not in global routing table

  Export VPN route-target communities

    RT:100:1

  Import VPN route-target communities

    RT:100:1                 RT:500:1

  No import route-map

  No export route-map

VRF vpn2; default RD <not set>; default VPNID 2:3

  No interfaces

  Connected addresses are not in global routing table

  No Export VPN route-target communities

  No Import VPN route-target communities

  No import route-map

  No export route-map

VRF vpn5; default RD 500:1; default VPNID <not set>

  Interfaces:

Additional References

The following sections provide references related to MPLS VPNs.

Related Documents


Standards

Standard
Title

IEEE Std 802-1990

IEEE Local and Metropolitan Area Networks: Overview and Architecture


MIBs

MIB
MIBs Link

None

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs


RFCs

RFC
Title

RFC 2685

Virtual Private Networks Identifier


Technical Assistance

Description
Link

The Cisco Technical Support website contains thousands of pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.

http://www.cisco.com/techsupport


Feature Information for Assigning an ID Number to a VPN

Table 1 lists the features in this module and provides links to specific configuration information.

Not all commands may be available in your Cisco IOS software release. For details on when support for specific commands was introduced, see the command reference documents.

Cisco IOS software images are specific to a Cisco IOS software release, a feature set, and a platform. Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

Note Table 1 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.

Table 1 Feature Information for Assigning an ID Number to a VPN

Feature Name
Releases
Feature Configuration Information

VPN ID

12.0(17)ST

12.2(4)B

12.2(8)T

12.2(14)S

This feature lets you you identify VPNs by a VPN identification number, as described in RFC 2685.

The following sections provide information about this feature:

•Components of the VPN ID

•Management Applications That Use VPN IDs

•How to Configure a VPN ID

MPLS VPN ID

Cisco IOS

For information about feature support in Cisco IOS software, use Cisco Feature Navigator.


Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2007 Cisco Systems, Inc. All rights reserved.