What is all this 'MPLS Fundamentals' Stuff!!!

Well, I have started reading the 'MPLS Fundamentals' book & was making some notes for revision later on when I am preparing for my lab. So thought that instead of keeping it with myself, I would share it with all you guys out there preparing for CCIE SP.

I will keep posting on every chapter as I go through the entire book!!

Hope it helps!!

MPLS Fundamentals - Chapter 4 – Review Questions

1. What is the fundamental purpose of LDP?

- The fundamental purpose of LDP is to carry the label bindings for the Forwarding Equivalence Classes (FECs) in the MPLS network.

 

2. Name the four main functions that LDP takes care of.?

- LDP has four major functions:

i) The discovery of LSRs that are running LDP

ii) Session establishment and maintenance

iii) Advertising of label mappings

iv) Housekeeping by means of notification

 

3. How can you reduce the number of label bindings on an LSR?

- Following are the 2 ways by which we can reduce the label bindings on an LSR:

You can configure LDP to advertise or not to advertise certain labels to certain LDP peers. You can then use the locally assigned labels that are advertised to the LDP peers as outgoing label on those LSRs. The syntax for this command is as follows: mpls ldp advertise-labels [vrf vpn-name] [interface interface |for prefix-access-list [to peer-access-list]]. The command mpls ldp request-labels is used instead of mpls ldp advertiselabels for LC-ATM interfaces. The Cisco IOS LDP implementation allows you to specify more than one mpls ldp advertiselabels for prefix-access-list to peer-access-list command. This brings greater flexibility when you are deciding which label bindings to send to which LDP peers.

 

You can filter out incoming label bindings from an LDP neighbor. In effect, this is the opposite of the feature that prevents the advertising of label bindings. You can use the inbound label binding filtering on the receiving LDP peer if you cannot apply the outbound filtering of label bindings, as described in the previous section. This feature can limit the number of label bindings stored in the LIB of the router. For instance, you can filter out all received label bindings from the LDP peers, except for the label bindings of the loopback interfaces of PE routers in an MPLS VPN network. Usually, these loopback interfaces have the BGP next-hop IP addresses, and the LSRs can use the label associated with that prefix to forward the labeled customer VPN traffic. Following is the command to enable the inbound label binding filtering: mpls ldp neighbor [vrf vpn-name] nbr-address labels accept acl

 

4. What problem does MPLS LDP-IGP synchronization solve?

- Following are the problems that MPLS LDP-IGP synchronization solves:

 

A common problem with MPLS networks that are running LDP is that when the LDP session is broken on a link, the IGP still has that link as outgoing; thus, packets are still forwarded out of that link. This happens because the IGP installs the best path in the routing table for any prefix. Therefore, traffic for prefixes with a next hop out of a link where LDP is broken becomes unlabeled.

 

Problem can occur when LSRs restart. The IGP can be quicker in establishing the adjacencies than LDP can establish its sessions. This means that the IGP forwarding is already happening before the LFIB has the necessary information to start the correct label forwarding. The packets are incorrectly forwarded (unlabeled) or dropped until the LDP session is established.

 

The problem that LDP-IGP Synchronization solves cannot happen with BGP and label distribution. Because BGP takes care of the binding advertisement and the control plane for IP routing, the before-mentioned problem cannot happen. Although it is possible for the IGP adjacency to be up while LDP is down on a link, BGP is either up or down, meaning that the installation of the IP prefix in the routing table by BGP is linked to the advertisement of the label binding for that prefix by BGP.

 

5. How many LDP sessions are established between two LSRs that have six links between them, of which two links are LC-ATM links and four are frame links?

- There would be 3 LDP sessions that would be needed between these two LSRs. One session for each LC-ATM link & one for the four frame links.

You might think that one LDP session between a pair of LSRs is enough to do the job. You might be right in most cases! When the per-platform label space is the only label space used between a pair of LSRs, one LDP session suffices. This is so because only one set of label bindings is exchanged between the two LSRs, no matter how many links are between them. Basically, the

interfaces can share the same set of labels when the per-platform label space is used. The reason for this is that all the label bindings are relevant to all the links between the two LSRs, because they all belong to the same label space. Interfaces belong to the per-platform label space when they are frame-mode interfaces. Interfaces that are not frame-mode interfaces—such as LC-ATM interfaces—have a per-interface label space. With per-interface label space, each label binding has relevance only to that interface. Therefore, for each interface that has a per-interface label space, one LDP session must exist between the pair of routers.

 

6. What do you need to configure to protect the LDP sessions against attacks?

- LDP sessions are TCP sessions. TCP sessions can be attacked by spoofed TCP segments. To protect LDP against such attacks, you can use Message Digest 5 (MD5) authentication. MD5 adds a signature—called the MD5 digest—to the TCP segments. The MD5 digest is calculated for the particular TCP segment using the configured password on both ends of the connection. The configured MD5 password is never transmitted. This would leave a potential hacker having to guess the TCP sequence numbers and the MD5 password.

 

7. What trick does MPLS LDP-IGP Synchronization employ to ensure that the link is not used to forward traffic while the LDP session is unsynchronized?

- When the MPLS LDP-IGP synchronization is active for an interface, the IGP announces that link with maximum metric until the synchronization is achieved, or until the LDP session is running across that interface. The maximum link metric for OSPF is 65536 (hex 0xFFFF). No path through the interface where LDP is down is used unless it is the only path. (No other paths have a better metric.) After the LDP session is established and label bindings have been exchanged, the IGP advertises the link with its normal IGP metric. At that point, the traffic is label-switched across that interface. Basically, OSPF does not form an adjacency across a link if the LDP session is not established first across that link. (OSPF does not send out Hellos on the link.)

Until the LDP session is established or until the synchronization Holddown timer has expired, the OSPF adjacency is not established. Synchronized here means that the local label bindings have been sent over the LDP session to the LDP peer. However, when the synchronization is turned on at router A and that router has only one link to router B and no other IP connectivity to router B via another path (this means via other routers), the OSPF adjacency never comes up. OSPF waits for the LDP session to come up, but the LDP session cannot come up because router A cannot have the route for the LDP router ID of router B in its routing table. The OSPF and LDP adjacency can stay down forever in this situation! If router A has only router B as a neighbor, the LDP router ID of router B is not reachable; this means that no route exists for it in the routing table of router A. In that case, the LDP-IGP synchronization detects that the peer is not reachable and lets OSPF bring up the adjacency anyway. In this case, the link is advertised with maximum metric until the synchronization occurs. This makes the path through that link a path of last resort.

In some cases, the problem with the LDP session might be a persistent one; therefore, it might not be desirable to keep waiting for the IGP adjacency to be established. The solution for this is to configure a Holddown timer for the synchronization. If the timer expires before the LDP session is established, the OSPF adjacency is built anyway. If everything is fine with LDP across that link, LDP also forms a session across the link. While OSPF is waiting to bring up its adjacency until LDP synchronizes, the OSPF interface state is down and OSPF does not send Hellos onto that link.

 

8. What does LDP Session Protection use to protect an LDP session?

- When the LDP session between two directly connected LSRs is protected, a targeted LDP session is built between the two LSRs. When the directly connected link does go down between the two LSRs, the targeted LDP session is kept up as long as an alternative path exists between the two LSRs. The LDP link adjacency is removed when the link goes down, but the targeted adjacency keeps the LDP session up. When the link comes back up, the LSR does not need to re-establish the LDP session; therefore, the convergence is better.

MPLS Fundamentals - Chapter 4 – Useful Commands

• Enable CEF with the global 'ip cef' command.
• Enable LDP globally with the 'mpls ip' command.
• To discover whether the LSR sends and receives LDP Hellos, the Hello interval, and the Hold time, use the 'show mpls ldp discovery [detail]' command.
• The 'show mpls interfaces' command allows you to quickly see which interfaces are running LDP.
• You can change the LDP router ID manually by using the command 'mpls ldp router-id interface [force]'.
• If the LDP peers agree on the session parameters, they keep the TCP connection between them. If not, they retry to create the LDP session between them, but at a throttled rate. In Cisco IOS, the LDP backoff command controls this throttling rate: 'mpls ldp backoff initial-backoff maximum-backoff'
• The command to change the LDP session keepalive timer is 'mpls ldp holdtime seconds'
• Another command to have a look at the LIB on the LSR is 'show mpls ip binding'.
• You can also see the discovery and session timers with the command 'show mpls ldp parameters'.
• To change the IP address, configure the command 'mpls ldp discovery transport-address {interface | ipaddress}' on the interface of the router and specify an interface or IP address to be used to create the LDP session.
• Command to check the LDP Neighbor Hold Time and KA Interval is 'show mpls ldp neighbor 10.200.254.5 detail'
• Command 'show mpls ldp bindings' shows the LIB on an LSR. The advantage of the command show mpls ip binding is that it also shows which label from all possible remote bindings is used to forward traffic by indicating inuse. Inuse indicates the outgoing label in the LFIB for that prefix.
• Command to see the label bindings for a specific prefix is 'show mpls ldp bindings <ip> <mask>'
• In older Cisco IOS software (pre 12.0(21)ST), the default behavior was not to send a Label Withdraw message to withdraw the label before advertising the new label for the FEC. The new label advertisement was also an implicit label withdraw. If you want to keep the old behavior, you must configure the command 'mpls ldp neighbor neighbor implicit-withdraw'.
• LDP received messages, excluding periodic Keep Alives debugging - 'debug mpls ldp messages received'
• LDP Label Information Base (LIB) changes debugging - 'debug mpls ldp bindings'
• For LDP neighbors that are not directly connected, the LDP neighborship needs to be configured manually on both the routers with the 'mpls ldp neighbor targeted' command.
• To change the LDP Hello interval and the Hold time for targeted LDP sessions, you can use the command 'mpls ldp discovery {hello {holdtime | interval} seconds | targeted-hello {holdtime | interval} seconds | accept [from acl]}'
• 'mpls ldp discovery targeted-hello accept [from acl]' command can be used to configure the other router to accept targeted LDP sessions from specific LDP routers.
• In Cisco IOS, you can configure MD5 for LDP by configuring a password for the LDP peer with the command 'mpls ldp neighbor [vrf vpn-name] ip-addr password [0-7] pswd-string'
• LDP lets you control the advertisement of labels. You can configure LDP to advertise or not to advertise certain labels to certain LDP peers using the command 'mpls ldp advertise-labels [vrf vpn-name] [interface interface | for prefix-access-list [to peer-access-list]]'
• Command to enable the inbound label binding filtering: 'mpls ldp neighbor [vrf vpn-name] nbr-address labels accept acl'
• The OSPF router command to enable LDP Autoconfiguration is this: 'mpls ldp autoconfig [area area-id]'
• The interface command to disable LDP Autoconfiguration on an interface is as follows: 'no mpls ldp igp autoconfig'
• 'show mpls interfaces detail' & 'show mpls ldp discovery detail' commands can be used to see if MPLS was configured using the interface comand or using the autoconfig command.
• The command to enable it for the IGP is 'mpls ldp sync', and it is configured under the router process.
• Disable MPLS LDP-IGP Synchronization on one particular interface with the command 'no mpls ldp igp sync'.
• By default, if synchronization is not achieved, the IGP waits indefinitely to bring up the adjacency. You can change this with the global command 'mpls ldp igp sync holddown msecs', which instructs the IGP to wait only for the configured time.
• Commands 'show mpls ldp igp sync serial 4/0' & 'show ip ospf mpls ldp interface' can be used to check the status of an interface in regards to the IGP-LDP synchronization.
• The command 'debug mpls ldp sync [interface <name>] [peer-acl <acl>]' provides debug information on the LDP synchronization.
• The global command to enable LDP Session Protection is 'mpls ldp session protection [vrf vpn-name] [for acl] [duration seconds]'
• For the protection to work, you need to enable it on both the LSRs. If this is not possible, you can enable it on one LSR, and the other LSR can accept the targeted LDP Hellos by configuring the command 'mpls ldp discovery targeted-hello accept'.

MPLS Fundamentals - Chapter 4 - Label Distribution Protocol

• Even if you have mpls enable on all the router/interfaces. If you do not have a IGP running among the routers they would not form ldp neighbor ship. Even if the interfaces are directly connected interfaces & you are able to ping them ldp will not form a neighbor relationship until there is a IGP running.
• On some routers by default tdp is used a the label distribution protocol while on other's ldp is the default, if there is a mismatch in the protocol on 2 router's trying to form a ldp neighbor ship, it would not work.
• The LFIB - which is the table that forwards labeled packets is fed by the label bindings found in the LIB. The LIB is fed by the label bindings received by LDP, Resource Reservation Protocol (RSVP), MP-BGP, or statically assigned label bindings.
• LDP has four major functions:

1.       The discovery of LSRs that are running LDP

2.       Session establishment and maintenance

3.       Advertising of label mappings

4.       Housekeeping by means of notification

• LDP Hello messages are UDP messages that are sent on the links to the 'all routers on this subnet' multicast IP address - in other words, to the 224.0.0.2 group IP multicast address. The UDP port used for LDP is 646.
• The Hello message contains a Hold time. If no Hello message is received from that LSR before the Hold time expires, the LSR removes that LSR from the list of discovered LDP neighbors.
• If the two LDP peers have different LDP Hold times configured, the smaller of the two values is used as the Hold time for that LDP discovery source. Cisco IOS might overwrite the configured LDP Hello interval. It will choose a smaller LDP Hello interval than configured so that it can send at least three LDP Hellos before the Hold time expires.
• This LDP ID is a 6-byte field that consists of 4 bytes identifying the LSR uniquely and 2 bytes identifying the label space that the LSR is using. If the last two bytes are 0, the label space is the platform-wide or per platform label space. If they are non-zero, a per-interface label space is used. If that is the case, multiple LDP IDs are used, where the first 4 bytes are the same value, but the last two bytes indicate a different label space. Per-interface label space is used for LC-ATM links.
• The first 4 bytes of the LDP ID are an IP address taken from an operational interface on the router. If loopback interfaces exist, the highest IP address of the loopback interfaces is taken for the LDP ID or LDP router ID. If no loopback interfaces exist, the highest IP address of an interface is taken.
• In Cisco IOS, the MPLS LDP router ID needs to be present in the routing table of the LDP neighboring routers. If it is not, the LDP session is not formed.
• If two LSRs have discovered each other by means of the LDP Hellos, they attempt to establish an LDP session between them. One LSR tries to open a TCP connection to TCP port 646 to the other LSR.
• The command to change the LDP session keepalive timer is 'mpls ldp holdtime seconds'.You can configure the value of the Hold time to be between 15 and 2,147,483 seconds, with a default of 180 seconds.
• When a router has multiple links toward another LDP router, the same transport address must be advertised on all the parallel links that use the same label space.
• When a router has multiple links toward another LDP router and a different transport address is advertised on those links, the TCP session is still formed, but there is a missing link from the LDP "discovery sources" on the other router. In the previous example, the LDP session is formed, but Ethernet 0/1/3 or Ethernet 0/1/4 is missing from the LDP discovery sources in the output of router london. As such, the traffic from router london toward router new-york is not load-balanced but uses only one outgoing Ethernet link.
• Interfaces belong to the per-platform label space when they are frame-mode interfaces. Interfaces that are not frame-mode interfaces such as LC-ATM interfaces have a per-interface label space.
• With per-interface label space, each label binding has relevance only to that interface. Therefore, for each interface that has a per-interface label space, one LDP session must exist between the pair of routers.
• One example in which the two LDP peers might disagree on the parameters and not form an LDP session is the case of LC-ATM, where the two peers are using different ranges of VPI/VCI values for the labels.
• After the LDP session has been set up, it is maintained by either the receipt of LDP packets or a periodic keepalive message. Each time the LDP peer receives an LDP packet or a keepalive message, the keepalive timer is reset for that peer.
• The downstream LSR is found by looking up the next hop for that prefix in the routing table. Only the remote binding associated with that next-hop LSR should be used to populate the LFIB. This means that only one label from all the advertised label bindings from all the LDP neighbors of this LSR should be used as outgoing label in the LFIB for that prefix. The problem is that the label bindings are advertised as (LDP Identifier, label) without the IP addresses of the interfaces. This means that to find the outgoing label for a particular prefix, you must map to the LDP Identifier the IP address of the interface—pointing back to this LSR—on the downstream LSR. You can only do this if each LDP peer advertises all its IP addresses. These IP addresses are advertised by the LDP peer with Address messages and withdrawn with Withdraw Address messages. You can find these addresses when you are looking at the LDP peer. They are called the bound addresses for the LDP peer.
• The concept of split horizon does not exist; an LDP peer assigns its own local label to a prefix and advertises that back to the other LDP peer, even though that other LDP peer owns the prefix (it is a connected prefix) or that other LDP peer is the downstream LSR.
• Examples in which the targeted LDP session is needed are AToM networks and TE tunnels in an MPLS VPN network.
• If one LSR has MD5 configured for LDP and the other not, the following message is logged: %TCP-6-BADAUTH: No MD5 digest from 10.200.254.4(11092) to 10.200.254.3(646)
• If both LDP peers have a password configured for MD5 but the passwords do not match, the following message is logged: %TCP-6-BADAUTH: Invalid MD5 digest from 10.200.254.4(11093) to 10.200.254.3(646)
• You do not have to clear the LDP neighbor to which you apply the mpls ldp advertise-labels command for it to take effect.
• "Interface config" indicates that LDP is enabled through the interface mpls ip command. "IGP config" indicates that LDP is enabled through the router mpls ldp autoconfig command.
• With MPLS VPN, AToM, Virtual Private LAN Switching (VPLS), or IPv6 over MPLS, the packets must not become unlabeled in the MPLS network. If they do become unlabeled, the LSR does not have the intelligence to forward the packets anymore and drops them.
• The solution is MPLS LDP-IGP Synchronization. This feature ensures that the link is not used to forward (unlabeled) traffic when the LDP session across the link is down. Rather, the traffic is forwarded out another link where the LDP session is still established.
• At the time of writing this book, the only IGP that is supported with MPLS LDP-IGP Synchronization is OSPF.
• The problem that LDP-IGP Synchronization solves cannot happen with BGP and label distribution. Because BGP takes care of the binding advertisement and the control plane for IP routing, the before-mentioned problem cannot happen. Although it is possible for the IGP adjacency to be up while LDP is down on a link, BGP is either up or down, meaning that the installation of the IP prefix in the routing table by BGP is linked to the advertisement of the label binding for that prefix by BGP.
• OSPF does not form an adjacency across a link if the LDP session is not established first across that link. (OSPF does not send out Hellos on the link.)
• By default, if synchronization is not achieved, the IGP waits indefinitely to bring up the adjacency. You can change this with the global command mpls ldp igp sync holddown msecs, which instructs the IGP to wait only for the configured time. After the synchronization Holddown timer expires, the IGP forms an adjacency across the link. As long as the IGP adjacency is up, while the LDP session is not synchronized, the IGP advertises the link with maximum metric.
• When the LDP session between two directly connected LSRs is protected, a targeted LDP session is built between the two LSRs.
• Finally, a useful LDP feature is LDP Graceful Restart. It specifies a mechanism for LDP peers to preserve the MPLS forwarding state when the LDP session goes down. As such, traffic can continue to be forwarded without interruption, even when the LDP session restarts.

MPLS Fundamentals - Chapter 3 – Review Questions

1. What does the push operation do on a labeled packet?

- The top label is replaced with a new label (swapped), and one or more labels are added (pushed) on top of the swapped label.

 

2. Which Cisco IOS command do you use to see what the swapped label is and which labels are pushed onto a received packet for a certain prefix?

- To see all the labels that change on an already labeled packet, you must use the 'show mpls forwarding-table [network {mask | length}] [detail]' command

 

3. What does the outgoing label entry of "Aggregate" in the LFIB of a Cisco IOS LSR mean?

- The outgoing label entry showing 'Aggregate' means that the aggregating LSR needs to remove the label of the incoming packet and must do an IP lookup to determine the more specific prefix to use for forwarding this IP packet.

 

5. What are the value and the function of the Router Alert label?

- The Router Alert label is the one with value 1. This label can be present anywhere in the label stack except at the bottom. When the Router Alert label is the top label, it alerts the LSR that the packet needs a closer look. Therefore, the packet is not forwarded in hardware, but it is looked at by a software process. When the packet is forwarded, the label 1 is removed. Then a lookup of the next label in the label stack is performed in the LFIB to decide where the packet needs to be switched

to. Next, a label action (pop, swap, push) is performed, the label 1 is pushed back on top of the label stack, and the packet is forwarded.

 

6. Why does an LSR forward the ICMP message "time exceeded" along the LSP of the original packet with the TTL expiring instead of returning it directly?

- The reason for this forwarding of the ICMP message along the LSP that the original packet with the expiring TTL was following is that in some cases the LSR that is generating the ICMP message has no knowledge of how to reach the originator of the original packet. Equally so, an intermediate LSR closer to the originator of the packet might not have that knowledge. One such case is a network with MPLS VPN. In this scenario, the P router does not have the knowledge to send back the ICMP messages to the originator of the VPN packet, because the P router does not have a route to directly return the ICMP message. (In general, the P routers do not hold the VPN routing tables.) Hence, the P router builds the ICMP message and forwards the packet along the LSP, in the hope that the ICMP message reaches a router at the end of the LSP that can return the packet to the originating routing. In the case of MPLS VPN, the ICMP message is returned by the egress PE or the CE that is attached to that PE, because these routers certainly have the route to correctly return the packet.

 

7. Is using Path MTU Discovery a guarantee that there will be no MTU problems in the MPLS network?

- Path MTU Discovery is not guaranteed to work in all cases; sometimes the ICMP message does not make it back to the originator. Possible causes for the ICMP message not making it to the originator of the packet are firewalls, access lists, and routing problems.

 

8. Why is MTU or MRU such an important parameter in MPLS networks?

- The interface MTU command in Cisco IOS specifies how big a Layer 3 packet can be without having to fragment it when sending it on a data link. For the Ethernet encapsulation, for example, MTU is by default set to 1500. However, when n labels are added, n * 4 bytes are added to an already maximum sized IP packet of 1500 bytes. This would lead to the need to fragment the packet.

Cisco IOS has the 'mpls mtu' command that lets you specify how big a labeled packet can be on a data link. If, for example, you know that all packets that are sent on the link have a maximum of two labels and the MTU is 1500 bytes, you can set the MPLS MTU to 1508 (1500 + 2 * 4). Thus, all labeled packets of size 1508 bytes (labels included) can be sent on the link without fragmenting them. The default MPLS MTU value of a link equals the MTU value.

Take the example of Ethernet: The payload can be a maximum of 1500 bytes. However, if the packet is a maximum sized packet and labels are added, the packet becomes slightly too big to be sent on the Ethernet link. It is possible to close one eye and allow frames that are bigger (perhaps by just a few bytes) to be sent on the Ethernet link, even though it is not the correct thing according to the Ethernet specifications, which say that such frames should be dropped. This is, of course, possible only if the Ethernet hardware in the router and all switches in the Ethernet network support receiving and sending baby giant frames.

On Ethernet data links on LSRs, you can set the MPLS MTU to 1508 bytes to allow IP packets with a size of 1500 bytes with two labels to be received and forwarded. If, however, the hardware of the router does not support this, or if an Ethernet switch exists in between, dropping baby giant frames, you can lower the MPLS MTU parameter on the LSRs. When you set the MPLS MTU to 1500, all the IP packets with a size of 1492 bytes are still forwarded, because the size of the labeled packet then becomes 1500 (1492 plus 8) bytes at Layer 3. However, all IP packets sized between 1493 through 1500 bytes (or more) are fragmented. Because of the performance impact of fragmentation, you should use methods to avoid it, such as path MTU discovery.

MPLS Fundamentals - Chapter 3 – Useful Commands

• You can see an extract from the LFIB, by issuing the command 'show mpls forwarding-table'.
• To see all the labels that change on an already labeled packet, you must use the 'show mpls forwarding-table [network {mask | length}] [detail]' command
• The command 'no mpls ip' on an interface disables LDP on that interface.
• 'debug mpls packet' to check the labels on the packets
• You can change the label range with the 'mpls label range min max' command.
• Use the command 'show mpls label range' to see the range of labels being currently used by the Cisco IOS.
• Cisco IOS has the 'mpls mtu' command that lets you specify how big a labeled packet can be on a data link.
• 'show mpls interfaces fastEthernet 2/6 detail' command would show you the MPLS MTU for an interface
• The command 'system jumbomtu' can be used to enable jumbo Ethernet frames on an Ethernet switch.

MPLS Fundamentals - Chapter 3 – Forwarding Labeled Packets

• In Cisco IOS, CEF switching is the only IP switching mode that you can use to label packets. Other IP switching modes, such as fast switching, cannot be used, because the fast switching cache does not hold information on labels. Because CEF switching is the only IP switching mode that is supported in conjunction with MPLS, you must turn on CEF when you enable MPLS on the router.
• If a prefix is reachable via a mix of labeled and unlabeled (IP) paths, Cisco IOS does not consider the unlabeled paths for load-balancing labeled packets. That is because in some cases, the traffic going over the unlabeled path does not reach its destination.
• Label 0 is the explicit NULL label, whereas label 3 is the implicit NULL label. Label 1 is the router alert label, whereas label 14 is the OAM alert label. The other reserved labels between 0 and 15 have not been assigned yet.
• The egress LSR signals the penultimate LSR to use implicit NULL by not sending a regular label, but by sending the special label with value 3. The use of implicit NULL at the end of an LSP is called penultimate hop popping (PHP)
• PHP is the default mode in Cisco IOS. In the case of IPv4-over-MPLS, Cisco IOS only advertises the implicit NULL label for directly connected routes and summarized routes.
• The use of the implicit NULL label does not mean that all labels of the label stack must be removed. Only one label is popped off. In any case, the use of the implicit NULL label prevents the egress LSR from having to perform two lookups. Although the label value 3 signals the use of the implicit NULL label, the label 3 will never be seen as a label in the label stack of an MPLS packet. That is why it is called the implicit NULL label.
• In Cisco IOS, however, a safeguard guards against possible routing loops by not copying the MPLS TTL to the IP TTL if the MPLS TTL is greater than the IP TTL of the received labeled packet.
• The default MPLS MTU value of a link equals the MTU value.
• In some Cisco IOS releases, you cannot configure the MPLS MTU to be bigger than the interface MTU.
• Maximum receive unit (MRU) is a parameter that Cisco IOS uses. It informs the LSR how big a received labeled packet of a certain FEC can be that can still be forwarded out of this LSR without fragmenting it. This value is actually a value per FEC (or prefix) and not just per interface.
• Path MTU Discovery is not guaranteed to work in all cases; sometimes the ICMP message does not make it back to the originator. Possible causes for the ICMP message not making it to the originator of the packet are firewalls, access lists, and routing problems.

MPLS Fundamentals - Chapter 2 – Review Questions

1. Name the four fields that are part of a label?

- Label (first 20bits)

- EXP (next 3 bits)

- BoS (next 1 bit)

- TTL (next 8bits)

In all 32 bits.

 

2. How many labels can reside in a label stack?

- No limit, but you seldom see labels more than 4 in a label stack.

 

3. In which layer does MPLS fit in the OSI reference model?

- The MPLS label sits between the frame (layer 2) & the transported protocol packet (layer3), hence it can be conceived to be at layer 2.5

 

4. Which table does an LSR use to forward labeled packets?

- Label Information Base (LIB) is used to store all the remote labels received from multiple adjacent LSR's. On the other hand the Label Forwarding Instance Base (LFIB) consists of only those labels from the LIB which are being currently used for taking forwarding decisions.

 

5. What type of interfaces in Cisco IOS uses the Downstream-on-Demand label distribution mode and the per-interface label space?

- In Cisco IOS, all interfaces except LC-ATM interfaces use the UD label distribution mode. All LC-ATM interfaces use the DoD label distribution mode.

 

6. Why does the MPLS label have a Time To Live (TTL) field?

- Bits 24 to 31 are the eight bits used for Time To Live (TTL). This TTL has the same function as the TTL found in the IP header. It is simply decreased by 1 at each hop, and its main function is to avoid a packet being stuck in a routing loop. If a routing loop occurs and no TTL is present, the packet loops forever. If the TTL of the label reaches 0, the packet is discarded.

MPLS Fundamentals - Chapter 2 - MPLS Architecture

• An ordered sequence of LSRs is a label switched path (LSP)
• LSP is unidirectional
• A Forwarding Equivalence Class (FEC) is a group or flow of packets that receive the same forwarding treatment throughout the MPLS network.
• All packets belonging to the same FEC have the same label. However, not all packets that have the same label belong to the same FEC, because their EXP values might differ; the forwarding treatment could be different, and they could belong to a different FEC.
• Labels are local to each pair of adjacent routers. Labels have no global meaning across the network.
• For every IGP IP prefix in its IP routing table, each LSR creates a local binding—that is, it binds a label to the IPv4 prefix. The LSR then distributes this binding to all its LDP neighbors. These received bindings become remote bindings. The neighbors then store these remote and local bindings in a special table, the label information base (LIB).
• The LFIB is the table used to forward labeled packets. It is populated with the incoming and outgoing labels for the LSPs. The incoming label is the label from the local binding on the particular LSR. The outgoing label is the label from the remote binding chosen by the LSR from all possible remote bindings. All these remote bindings are found in the LIB. The LFIB chooses only one of the possible outgoing labels from all the possible remote bindings in the LIB and installs it in the LFIB.
• In the case of MPLS traffic engineering, the labels are distributed by RSVP. In the case of MPLS VPN, the VPN label is distributed by BGP.
• If per-platform label space is used, the packet is forwarded solely based on the label, independently from the incoming interface.
• If per-interface label space is used, the packet is not forwarded solely based on the label, but based on both the incoming interface and the label.
• In Cisco IOS, all Label Switching Controlled-ATM (LC-ATM) interfaces have a per-interface label space, whereas all ATM frame-based and non-ATM interfaces have a per-platform label space.
• In Cisco IOS, all interfaces except LC-ATM interfaces use the UD label distribution mode. All LC-ATM interfaces use the DoD label distribution mode.
• In Cisco IOS, the retention mode for LC-ATM interfaces is the CLR mode. It is the LLR mode for all other types of interfaces.
• Cisco IOS uses Independent LSP Control mode. ATM switches that are running Cisco IOS use Ordered LSP Control mode by default.

MPLS Fundamentals - Chapter 1 – Review Questions

1. What are the MPLS applications mentioned in this chapter?

- Traffic engineering

- MPLS VPNs

- AToM

 

2. Name three advantages of running MPLS in a service provider network.

- The use of one unified network infrastructure

- Better IP over ATM integration

- The core routers in the service provider network no longer need to run BGP.

- Adding one customer site means that on the PE router, only the peering with the CE router must be added. You do not have to hassle with creating many virtual circuits as with the overlay model or with configuring packet filters or route filters with the peer-to-peer VPN model over an IP network. This is the benefit of MPLS VPN for the service provider.

- As the operator of the MPLS-with-traffic-engineering-enabled network, you can steer the traffic from A to B over the bottom path, which is not the shortest path between A and B (four hops versus three hops on the top path).

- An extra advantage of running MPLS traffic engineering is the possibility of Fast ReRouting(FRR).

 

3. What are the advantages of the MPLS VPN solution for the service provider over all the other VPN solutions?

- The peer-to-peer VPN model demanded a lot from provisioning because adding one customer site demanded many configuration changes at many sites. MPLS VPN is one application of MPLS that made the peer-to-peer VPN model much easier to implement. Adding or removing a customer site is now easier to configure and thus demands much

less time and effort. With MPLS VPN, one customer router, called the customer edge (CE) router, peers at the IP Layer with at least one service provider router, called the provider edge (PE) router. Adding one customer site means that on the PE router, only the peering with the CE router must be added. You do not have to hassle with creating many virtual circuits as with the overlay model or with configuring packet filters or route filters with the peer-to-peer VPN model over an IP network. This is the benefit of MPLS VPN for the service provider.

 

4. Name the four technologies that can be used to carry IP over ATM.

- RFC 1483,"Multiprotocol Encapsulation over ATM Adaptation Layer 5"

- LAN Emulation (LANE).

- Multiprotocol over ATM (MPOA)

- MPLS on ATM

 

5. Name two pre-MPLS protocols that use label switching.

- Frame relay

- ATM

 

6. What do the ATM switches need to run so that they can operate MPLS?

- The ATM switches had to run an IP routing protocol and implement a label distribution protocol

 

7. How do you ensure optimal traffic flow between all the customer sites in an ATM or Frame Relay overlay network?

- Because the ATM or Frame Relay switches are purely Layer 2 devices, the routers interconnect through them by means of virtual circuits created between them. For any router to send traffic directly to any other router at the edge, a virtual circuit must be created between them directly. Creating the virtual circuits manually is tedious. In any case, if the requirement is the any-to-any connection between sites, it is necessary to have a full mesh of virtual circuits between the sites, which is cumbersome and costly. If the sites are only interconnected as in the traffic from CE1 to CE3 must first go through CE2.