Saturday, February 4, 2012

MPLS OSPF PE-CE LOOP PREVENTION

LOOP PREVENTION IN OSPF PE TO CE
----------------------------------
When a type 3 LSA is sent from a PE router to a CE router the DN bit [ospf-dn] in the lsa
options field must be set.


 This is used to ensure that if any CE router sends this type3 LSA
to a PE router the pe router will not futher redistribute
It is sort like route-tagging in redistribution to stop route feeback this auto built into
the process

With a type 5 lsa it is slightly different with a type 5 sla a route tag is attached in the
cisco ios it uses the bgp process that it is coming from when the other pe recieves the route
it will see its bgp as in the tag and will not redistribute the route.

This can cause issues if a customer for some reason on another is using vrf. For example say
a customer has requirements for vrf lite. By default it is built in that if vrf process
recieves a route with the down bit set it will not redistribute so this potential issue that
customer may not recieve type 3 lsa from the PE

There is a way of telling the vrf to ignore the down bit check with do this with the command
router osof 100 vrf " vrf name"
capability vrf-lite

another potential way we could get around this is if we purposely set the domain id not to
match on one of the pe the routes would be redistributed in as external since they are
external they would not have the down bit set they would have the route tag with the BGP AS
number but since the vrf lite in the customer network would not be running bgp it will
process in.

LAB
----

S1
---

s1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     155.0.0.0/24 is subnetted, 1 subnets
C       155.0.79.0 is directly connected, Vlan79
     55.0.0.0/32 is subnetted, 1 subnets
O IA    172.25.17.0 [110/2] via 172.25.15.6, 00:00:08, Vlan67
C       172.25.16.0 is directly connected, FastEthernet0/14
C       172.25.15.0 is directly connected, Vlan67
     22.0.0.0/32 is subnetted, 1 subnets
O IA    22.1.1.1 [110/3] via 172.25.15.6, 00:00:08, Vlan67
     12.0.0.0/32 is subnetted, 1 subnets
C       12.1.1.1 is directly connected, Loopback0

if we check out 22.1.1.1
s1#sh ip ospf database summary 22.1.1.1
            OSPF Router with ID (12.1.1.1) (Process ID 100)
                Summary Net Link States (Area 0)
  Routing Bit Set on this LSA
  LS age: 141
  Options: (No TOS-capability, DC, Downward)
  LS Type: Summary Links(Network)
  Link State ID: 22.1.1.1 (summary Network Number)
  Advertising Router: 66.66.66.66
  LS Seq Number: 80000001
  Checksum: 0x1286
  Length: 28
  Network Mask: /32
        TOS: 0  Metric: 2
s1#
notice we are recieving with the downward bit set this is stop situation where s1 would pass
to s2 and s2 then to r5 who redistribute back into the mpls

lets create a vrf on s1
s1(config)#ip vrf E
s1(config-vrf)#rd 116:16

s1(config)#int vlan 67
s1(config-if)#ip vrf forwarding E
% Interface Vlan67 IP address 172.25.15.1 removed due to enabling VRF E
s1(config-if)#i
00:29:19: %OSPF-5-ADJCHG: Process 100, Nbr 66.66.66.66 on Vlan67 from FULL to DOWN, Neighbor
Down: Interface down or detache
s1(config-if)#ip address 172.25.15.1 255.255.255.0
s1(config-if)#

we will do a clean config of ospf
s1(config)#no router ospf 100
s1(config)#router ospf 100 vrf E
s1(config-router)#network 172.25.15.0 0.0.0.255 area 0
s1(config-router)#

00:30:26: %OSPF-5-ADJCHG: Process 100, Nbr 66.66.66.66 on Vlan67 from LOADING to FULL,
Loading Done
s1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     155.0.0.0/24 is subnetted, 1 subnets
C       155.0.79.0 is directly connected, Vlan79
     172.25.0.0/24 is subnetted, 1 subnets
C       172.25.16.0 is directly connected, FastEthernet0/14
     12.0.0.0/32 is subnetted, 1 subnets
C       12.1.1.1 is directly connected, Loopback0
s1#

This is because we have vrf it is doing the downward bit check this bit is checked so it is
not putting the routes in the routing table. We know there is not potential of a loop by s11
having these routes so we can over ride

s1(config-router)#router ospf 100 vrf E
s1(config-router)#cabability vrf-lite

the ospf process goes down and comes back up and we now have the ospf routes
00:36:23: %OSPF-5-ADJCHG: Process 100, Nbr 66.66.66.66 on Vlan67 from FULL to DOWN, Neighbor
Down: Interfa
00:36:31: %OSPF-5-ADJCHG: Process 100, Nbr 66.66.66.66 on Vlan67 from LOADING to FULL,
Loading Done

We are now getting the routes
s1(config-router)#do sh ip route vrf E
Routing Table: E
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
O IA    172.25.17.0 [110/2] via 172.25.15.6, 00:01:31, Vlan67
O IA    172.25.16.0 [110/3] via 172.25.15.6, 00:01:31, Vlan67
C       172.25.15.0 is directly connected, Vlan67
     22.0.0.0/32 is subnetted, 1 subnets
O IA    22.1.1.1 [110/3] via 172.25.15.6, 00:01:32, Vlan67
s1(config-router)#

lets turn this off and look at another way of doing it
s1(config)#router ospf 100
s1(config-router)#no capability vrf-lite
s1(config-router)#
s1(config-router)#do sh ip route vrf E
Routing Table: E
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     172.25.0.0/24 is subnetted, 1 subnets
C       172.25.15.0 is directly connected, Vlan67
s1(config-router)#

so we were back to not recieving the inter area routes

if we make them come in external as the check on bgp as it should be fine as we are not
running bgp on s1

r6
---
r6(config)#router ospf 100
r6(config-router)#domain-id 6.6.6.6
r6(config-router)#

S1
---
s1#sh ip route vrf E
Routing Table: E
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set

     172.25.0.0/24 is subnetted, 3 subnets
O E2    172.25.17.0 [110/1] via 172.25.15.6, 00:00:01, Vlan67
O E2    172.25.16.0 [110/2] via 172.25.15.6, 00:00:01, Vlan67
C       172.25.15.0 is directly connected, Vlan67
     22.0.0.0/32 is subnetted, 1 subnets
O E2    22.1.1.1 [110/2] via 172.25.15.6, 00:00:02, Vlan67
s1#

we are now getting the routes

No comments:

Post a Comment