MPLS wrap-up & IPSEC Intro.

Well I finished up MPLS today by finishing the rest of my reading, looking over weak areas, and doing shows and debugs from my already constructed labs. Trying to explain everything to another guy on the networking team felt like it helped my understanding out as well. We looked through the MPLS VPN lab, and traced labels throughout the topology, and also verified them against the routes in the routing tables (both the main routing table, and the vrf's). Very much worth the time! Also, by chance, learned that the command show ip protocols vrf [name] had ALOT of pertinent information in it...especially regarding redistributed protocols/AS's as well as neighbors.

Then I watched the nuggets regarding IPSEC introduction.  Much of it a review for me at this point, but still learned some good stuff.  IPSEC attempts to achieve:

1. Authentication
   
2. Data Integrity (SHA1 -{160 bit}, MD5 {128 bit}, etc...)
3. Confidentiality (DES, 3DES, AES, RSA)
4. Anti-replay

These are negotiated via IKE (internet key exchange)

There are 2 IPSEC modes:
Transparent and Tunnel

Symmetric encryption == both ends have the same keys (DES, 3DES, AES)
Asymmetric encryption == public/private keys (RSA, DH)

IPSEC is a "protocol suite"

MPLS

So...I am trying to MASTER the MPLS portion of the ISCW before moving on to the next topic.  I have spent about 3 days on it thus far, and will probably give it through tomorrow.  I have read all the MPLS chapters in the ISCW Authorized Self Study guide, watched the nuggets, and completed the labs in the portfolio.  Man, I really dont even know where to begin...there is soooo much with MPLS, and only a portion of it is even covered by this exam.  I do however feel that my knowledge on the matter is growing, and it is something that peaks my interest.  Lets go over the labs first:

4-1 Frame Mode MPLS
Diagram (sorry!):
[R1]----------[R2]----------[R3]

Easy enough!  Started by configuring loopbacks and serial IP's to the interfaces.  I then ran eigrp on the interfaces and advertised all loopbacks and serials.  Ensured end-to-end connectivity by pinging from R1's loopback to R3's loopback interfaces, checking routing tables, and show ip eigrp commands.  Then configured MPLS as follows:

 (config) ip cef  \\enabled cisco express forwarding
(config-if) mpls ip \\enabled mpls on all mpls interfaces
(config-if) mpls label protocol ldp \\set ldp as the label distro. protocol
(config-if) mpls mtu 1512 \\set the mtu to 12 > than 1500 to accomodate 3 X 4 byte labels

Verified with:

show mpls ldp bindings
show mpls forwarding-table
show mpls interfaces [type] [number] [detail]

This was a basic frame mode mpls configuration.  As you can tell this is done over ethernet, thus the "frame" mode.  This is opposed to mpls over atm; which is known as mpls cell mode.

The next lab was a bit more challenging....guess thats why it is called the "challenge" lab.
Lab 4-2 MPLS VPN's
[HQ]-------[SP1]-------[SP2]--------[SP3]---------[Branch]

This is hard to even explain....

1. Set up interfaces with loopbacks, ip's, etc...
2. Configured ospf over service provider network
3. configured MPLS in SP domain
4. Configured a virtual routing and forwarding table for the "customer"
1. ip vrf "name"
2. rd 100:1  \\route distinguisher...unique for each "customer"
3. route-target both 1:100  \\will help if the customer uses multiple vpn's
4. (config-if) ip vrf forwarding "name"  \\do this on the customer facing interface
1. Verify with ping vrf "name" [ip]
5. Configured eigrp AS 1 on both customer routers advertising networks
6. Configured eigrp AS 100 on PE routers SP1 and 3 and then set up the ipv4 vrf
1. address-family ipv4 vrf customer
2. autonomous-system 1  \\customers as
3. no auto
4. network [ip]
1. Verify with show ip route vrf "name"
   
7. BGP setup on PE routers SP1 and SP3
1. router bgp as
2. neighbor [ip] remote-as [as]
3. neighbor [ip] update-sourec loop0
4. address-family vpnv4
5. neighbor [ip] activate
6. neighbor [ip] send-community both
7. exit
8. address-family ipv4 vrf customer
9. redistribute eigrp 1
8. Redistribute bgp routes into eigrp
1. address-family ipv4 vrf customer
2. redistribute bgp [as] metric 64 1000 255 1 1500
   

And done....that one was a real brainwasher. Made me re-evaluate everything I thought that I knew about MPLS. Like I said...I will do some re-study tomm. and probably move on to the next topic by Wednesday.

MPLS

LSR - Label Switch Router
LIB - Label Information Base
LFIB (Action table) - Label Forwarding Information Base
PE - Provider Edge
LDP - Label Distribution Protocol
VRF - Virtual Routing and Forwarding

Placing the label = "Pushing" the lable
Removing the label = "Popping" the label

Control Plane - L3 routing exists here, label exchanging protocols LDP operates here
Data Plane -  "Forwarding plane", send data at L2/L3, and does the label swapping

I'm tired....


MPLS FRAME MODE CONFIGURATION...

(config) ip cef

(config-if) mpls ip

(config_if)mpls label protocol ldp

(config-if)mpls mtu 1512

show mpls ldp neighbor

show mpls ldp bindings

Route Distinguisher - 64 bit tag prepened to IPv4 address and routes that works to identify a particular customer (i.e. "customer1", "cust23")
Route Target - allows a customer to belong to multiple vpns....need to look more into this...

Good night...i'm exhausted from work and study and family