This is a backbone setup or router infrastructure scenario, using IPv6 only, SR-MPLS, IS-IS, iBGP. Most basic type of a layer 3 iBGP VPN. The BGP speakers are not directly connected and must use other protocols to transport that IP packet across the backbone to its target. More details on the used network topology and its configuration can be found in the BRKSPG-2203 presentation (Slide Nr. 48/Page Nr. 116).BRKSPG-2203.

FRRouting version and the linux kernel used in this netlab on all routers.

Network topology

Star topology, where all PE edge routers are not directly connected.

      PE2
       |
       |
PE1 -- P1 -- PE3
       |
       |
      RRv6

• All links are IPv6 only
• All links are (IS-IS) point to point
• IPv4 only on PE router ports eth6-8

Table overview of the configured router-id's, labels, and the NSAP addresses.

Labels are only created for IPv6 prefixes, no labels for IPv4. All IS-IS routers are level-2-only. PE routers have internal BGP neighorship to the BGP route reflector RRv6.

Configuration overview

Building a simple backbone, where the routers will forward IPv4 without using IPv4 for transport itself.

ALL routers use following protocols. IS-IS is level-2-only for all routers:

• IS-IS (level-2-only)
• IPv6
• MPLS (label)

The PE routers and RR additionally have BGP configuration

• BGP

The PE routers ONLY, have following configured and need specific linux preparations steps for the VRF to work in FRRouting:

• VRF
• IPv4

P1 and RRv6 have no ip forwarding configured.

CE (customer edge) routers connected to each PE (provider edge) router, which are NOT depicted in the network topology. Each CE (customer edge) router is connected to the set of eth6-eth8 ports.

All PE routers have 3 VRF's:

• vpn10 - IPv4 only
• vpn20 - IPv4/IPv6 IP dual-stack
• vpn60 - IPv6 only

Configuration

Use the Building 64bit alpine linux GNS3 FRRouting appliance setup. Following things need to be added to make this network topology work with this appliance.

linux

This step is only needed for the FRRouting PE routers, VRF creation and interface assignment using the iproute2 linux tool before FRRouting daemon starts:

On the example of the VRF vpn10

• VRF name - vpn10
• VRF table id - 10
• VRF interface - eth8

Full configuration for all interfaces on all routers. Create needed files:

cat>/etc/local.d/10_vrf_vpn10.start
ip link add vpn10 type vrf table 10
ip link set dev vpn10 up
ip link set dev eth8 master vpn10

cat>/etc/local.d/20_vrf_vpn20.start
ip link add vpn20 type vrf table 20
ip link set dev vpn20 up
ip link set dev eth7 master vpn20

cat>/etc/local.d/60_vrf_vpn60.start
ip link add vpn60 type vrf table 60
ip link set dev vpn60 up
ip link set dev eth6 master vpn60

Make created files executable:

chmod +x /etc/local.d/*.start

Add the local to the boot running stage on alpine's open-rc:

rc-update add local boot

Reason adding the local startup routine to boot, for FRRouting some IP kernel and interface configurations need to be in place and finished when FRRouting daemon starts. Now the linux PE routers setup is finished.

Using this preparation step, everything else below is only FRR configuration and done from the vtysh prompt.

P1

The P1 router - provider core router, P1 has no ip forwarding configured:

config
hostname P1
no ip forwarding
!
ip router-id 1.2.3.4
ipv6 router-id a::1234
!
interface eth1
 ipv6 router isis 1
 isis network point-to-point
 mpls enable
exit
!
interface eth2
 ipv6 router isis 1
 isis network point-to-point
 mpls enable
exit
!
interface eth3
 ipv6 router isis 1
 isis network point-to-point
 mpls enable
exit
!
interface eth6
 ipv6 router isis 1
 isis network point-to-point
 mpls enable
exit
!
interface lo
 ipv6 address a::1234/128
 ipv6 router isis 1
 isis passive
 mpls enable
exit
!
router isis 1
 is-type level-2-only
 net 49.0001.1234.1234.1234.00
 lsp-timers gen-interval 1 refresh-interval 65235 max-lifetime 65535
 spf-interval 2
 mpls-te on
 mpls-te router-address ipv6 a::1234
 segment-routing on
 segment-routing node-msd 8
 segment-routing prefix a::1234/128 index 1236
exit
end

Simple core router configuration.

PE1

Example customer facing interface addressing for the PE1 router - example interface addressing

• eth8 - vpn10 - 10.10.1.0/24
• eth7 - vpn20 - 10.20.1.0/24 - 2001:db8:1:20::/64
• eth6 - vpn60 - 2001:db8:1:60::/64

Resulting PE1 router configuration:

config
frr version 10.3.1
hostname PE1
!
ip router-id 1.1.1.1
ipv6 router-id a::1
!
vrf vpn10
 ip router-id 1.1.1.1
exit-vrf
!
vrf vpn20
 ip router-id 1.1.1.1
 ipv6 router-id a::1
exit-vrf
!
vrf vpn60
 ipv6 router-id a::1
exit-vrf
!
interface eth1
 ipv6 router isis 1
 isis network point-to-point
 mpls enable
exit
!
interface eth6 vrf vpn60
 ipv6 address 2001:db8:1:60::/64
exit
!
interface eth7 vrf vpn20
 ip address 10.20.1.1/24
 ipv6 address 2001:db8:1:20::/64
exit
!
interface eth8 vrf vpn10
 ip address 10.10.1.1/24
exit
!
interface lo
 ipv6 address a::1/128
 ipv6 router isis 1
 isis passive
 mpls enable
exit
!
router bgp 1
 bgp router-id 1.1.1.1
 bgp log-neighbor-changes
 neighbor RRv6 peer-group
 neighbor RRv6 remote-as 1
 neighbor RRv6 update-source lo
 neighbor RRv6 capability extended-nexthop
 neighbor a::4 peer-group RRv6
 !
 address-family ipv4 vpn
  neighbor RRv6 activate
  neighbor RRv6 next-hop-self
 exit-address-family
 !
 address-family ipv6 vpn
  neighbor RRv6 activate
  neighbor RRv6 next-hop-self
 exit-address-family
exit
!
router bgp 1 vrf vpn10
 bgp router-id 1.1.1.1
 !
 address-family ipv4 unicast
  redistribute connected
  label vpn export auto
  rd vpn export 1:10
  rt vpn both 1:10
  export vpn
  import vpn
 exit-address-family
exit
!
router bgp 1 vrf vpn20
 bgp router-id 1.1.1.1
 !
 address-family ipv4 unicast
  redistribute connected
  label vpn export auto
  rd vpn export 1:20
  rt vpn both 1:20
  export vpn
  import vpn
 exit-address-family
 !
 address-family ipv6 unicast
  redistribute connected
  label vpn export auto
  rd vpn export 1:20
  rt vpn both 1:20
  export vpn
  import vpn
 exit-address-family
exit
!
router bgp 1 vrf vpn60
 bgp router-id 1.1.1.1
 !
 address-family ipv6 unicast
  redistribute connected
  label vpn export auto
  rd vpn export 1:60
  rt vpn both 1:60
  export vpn
  import vpn
 exit-address-family
exit
!
router isis 1
 is-type level-2-only
 net 49.0001.1111.1111.1111.00
 lsp-timers gen-interval 1 refresh-interval 65235 max-lifetime 65535
 spf-interval 2
 mpls-te on
 mpls-te router-address ipv6 a::1
 segment-routing on
 segment-routing node-msd 8
 segment-routing prefix a::1/128 index 106
exit
end

The full configuration of the other both PE routers are found down down below.

RRv6

The BGP route reflector configuration is tiny compared to the the PE routers.

config
frr version 10.3.1
hostname RRv6
!
ip router-id 6.6.6.6
ipv6 router-id a::4
!
interface eth6
 ipv6 router isis 1
 isis network point-to-point
exit
!
interface lo
 ipv6 address a::4/128
 ipv6 router isis 1
 isis passive
exit
!
router bgp 1
 bgp router-id 6.6.6.6
 bgp log-neighbor-changes
 neighbor iBGP peer-group
 neighbor iBGP remote-as 1
 neighbor iBGP update-source lo
 neighbor iBGP capability extended-nexthop
 neighbor a::1 peer-group iBGP
 neighbor a::2 peer-group iBGP
 neighbor a::3 peer-group iBGP
 !
 address-family ipv4 vpn
  neighbor iBGP route-reflector-client
  neighbor a::1 activate
  neighbor a::2 activate
  neighbor a::3 activate
 exit-address-family
 !
 address-family ipv6 vpn
  neighbor iBGP activate
  neighbor iBGP route-reflector-client
 exit-address-family
exit
!
router isis 1
 is-type level-2-only
 net 49.0001.6666.6666.6666.00
 lsp-timers gen-interval 1 refresh-interval 65235 max-lifetime 65535
 spf-interval 2
 mpls-te on
 mpls-te router-address ipv6 a::4
 segment-routing on
 segment-routing node-msd 8
 segment-routing prefix a::4/128 index 606
exit
end

Full router configurations

Full configurations for all routers in the network topology. Just copy paste into your routers and if everything is setup correctly, enjoy the working protocols:

• P1 full configuration
• PE1 full configuration
• PE2 full configuration
• PE3 full configuration
• RRv6 full configuration

Verify

The verification part. Everything relies on IPv6 connectivity. Output of show ip route command, is empty on the routers.

IP addressing

Show the connected IP prefixes and the interfaces on PE1 router.

show interface brief

IPv4 pushed to the edge ports. Good.

IPv4 routing

For IP is nothing configured, here the output of the show ip route command on one of the routers:

No IPv4 in the default routing table. Very good.

IPv6 routing

Display the (default) ipv6 routing table:

show ipv6 route

The IPv6 default routing table contains all IPv6 loopback addresses of the neighbor routers. Notice the labels attached to IPv6 prefixes. implicit-null set only when directly connected neighbor AND when the router is the end target.

IPv4 VRF

The default routing table is empty. IPv4 has been pushed to VRF only. Displaying the output of VRF vpn10 and VRF vpn20 on the PE1 router:

show ip route vrf all

Great to see next hops via a::3 via link-local - 16306/81 in a IPv4 routing table.

IPv6 VRF

Verify the VRF vpn60 has IPv6 routes:

show ipv6 route vrf vpn60

Each PE router can have its own BGP VPN label index, label index is local to PE. Might even change during reboots of the router.

BGP IPv4 VPN

Show all the BGP VPN routes for IPv4:

show bgp ipv4 vpn 

vpn10 and vpn20 IP routes are displayed on the output, with the announcing BGP neighbors. All next hops are IPv6 only.

BGP IPv6 VPN

Display the IPv6 VPN BGP routes, this router know about:

show bgp ipv6 vpn

Here vpn20 and vpn60 routes. All next hops are IPv6 only.

MPLS label/SID

Verify the label and SID state, using the command show mpls table. This command will show the currently used (MPLS) SID's and BGP VPN (MPLS) labels. The vpn label index is local to PE, each PE router has its own vpn label index.

show mpls table

Each operating VRF address-family has its own label/SID assigned. IPv4 prefixes are not present at all. This is good. Forwarding IPv4 without using IPv4. IPv4 as a service.

SR MPLS node

Known, IS-IS SR MPLS nodes overview, All IS-IS routers in the topology must be listed

show isis segment-routing node

IS-IS (neighbor) detail

Using the `show isis database detail command inspect the database of each IS-IS router's entry. Displaying its configured specific and the state:

show isis database detail

The IS-IS database, is identical among all routers in the same level level2.

CE21 IP routing

CE21 connected to VRF named vpn20, dual-stack, connected to the PE1 router:

Verfiy the IP connectivity to CE22. Configuration of the CE21 router connected to vpn20 on R1 eth7:

CE21#sh run int e0/0 
Building configuration...

Current configuration : 100 bytes
!
interface Ethernet0/0
 ip address 10.20.1.10 255.255.255.0
 ipv6 address 2001:DB8:1:20::1/64
end

CE21#sh run | i route
ip route 0.0.0.0 0.0.0.0 10.20.1.1
ipv6 route ::/0 2001:DB8:1:20::

CE21 ICMP(v6)

The ICMP test is successful to CE22:

CE21#ping 10.20.2.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.20.2.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

Things work.

ICMPv6 echo test to CE22 looking good too:

CE21#ping 2001:DB8:2:20::1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:2:20::1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 ms

Good.

CE22 ICMP(v6)

CE22 router is connected to PE2 router.

CE22#ping 10.20.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.20.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

ICMPv6 test successful:

CE22#ping 2001:db8:1:20::
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:1:20::, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

CE22 traceroute

Traceroute to CE21 router across the backbone:

CE22#traceroute 2001:db8:1:20::1
Type escape sequence to abort.
Tracing the route to 2001:DB8:1:20::1

  1 2001:DB8:2:20:: 10 msec 0 msec 1 msec
  2  *  *  * 
  3 2001:DB8:1:20::1 14 msec 4 msec 1 msec

CE22#traceroute 10.20.1.10
Type escape sequence to abort.
Tracing the route to 10.20.1.10
VRF info: (vrf in name/id, vrf out name/id)
  1 10.20.2.1 1 msec 0 msec 0 msec
  2  *  *  * 
  3 10.20.1.10 5 msec 4 msec 3 msec

Summary

Using labels or MPLS labels with ISIS, removing IPv4 addressing completely from the basic router configuration, and delivering IPv4 connectivity across a IPv4 free running, SR-MPLS backbone. This is working good with FRRouting, at least in my netlab above. The advantage in configuring and operating SR-MPLS is that separate and lengthy LDP configuration falls away. Labels/SID's are generated using the IGP here IS-IS. BGP MPLS VPN labels are generated like if was LDP configured. It is sure not easy to migrate a LDP-MPLS based P backbone to a SR-MPLS, but when setting up a new routed network, from scrath then using SR-MPLS and IS-IS are the right choice.

Some years ago, 5 years, I have been exited about SR-MPLS working on OSPFv3, and pointing out the lacking IS-IS SR-MPLS support, aka FRRouting 7.2. Nowaways SR-MPLS is working and operating technology in FRRouting 10.3.1. Even better it works all on a IPv4 free core to the edge. Minimizing the ressources spent on building a networking solution.

Using the topology above and swapping SR-MPLS with SRv6 instead, does not work for ipv4 vpn/vpnv4 address family, at least it does not work for me. You might try out your own luck netlabbing this. The ipv6 vpn/VPNv6 address-family is working correctly with SRv6 uSID usid-f3216 configuration.

See also

Listed blog entries have identical network topology using the same networking protocols but are running on different NOS(Networking Operating System):

• Huawei VRP Segment Routing MPLS tech demo
• Huawei VRP SRv6 BRKSPG-2203 example netlab

References

• BRKSPG-2203 Presentation
• Building 64bit alpine linux GNS3 FRRouting appliance
• FRRouting SR Segment Routing tech demo