|
|
Cisco VPN Solutions Center: MPLS Solution is an MPLS VPN provisioning and auditing tool. The software focuses on the provider edge routers (PEs), customer edge routers (CEs), and the link between them. MPLS VPN Solution software integrates with Cisco IP Manager for element management tasks such as downloading configlets to target routers. Additional features include Class of Service (CoS) provisioning, VPN-aware NetFlow accounting, and Service Level Agreement (SLA) monitoring.
The MPLS VPN Solution product also provides external access to its provisioning, accounting, and SLA monitoring features through CORBA APIs.
Before you start the MPLS VPN Solution software, complete these tasks:
Step 2 To keep the startup operations conveniently organized, open three terminal windows---the first window for the xhost process, the second window for the VPN Console and Watchdog user interface, and the third window for Orbix.
Step 3 In the first terminal window, enter the following command:
xhost MPLS_VPN_hostname
The MPLS_VPN_hostname parameter is the name of the MPLS VPN workstation. This command configures your system so that the Orbix user (orbixadm) and the MPLS VPN user (vpnadm) can communicate with the client system.
Step 2 Log in as the owner of the Orbix process (orbixadm).
rlogin computer_name -l orbixadm
or
su - orbixadm
Step 3 Go to the directory where Orbix is installed.
cd /opt/orbixadm/orbix/Orbix3
Step 4 Source the environment as required for your shell:
C-Shell: source setenvs.csh
K-Shell: . ./setenvs.sh
Step 5 Start the Orbix process in the background:
orbixd &
Step 2 Log in as the owner of the MPLS VPN Solution software (vpnadm).
rlogin computer_name -l vpnadm
or
su - vpnadm
Step 3 Go to the MPLS VPN Solution installation directory.
cd /opt/vpnadm/vpn/
Step 4 Source the environment as required for your shell.
C-Shell: source vpnenv.csh
K-Shell: . ./vpnenv.sh
Step 5 Start the application's Watchdog processes:
startwd
 |
Note To stop the Watchdog process and its user interface, issue the stopwd command. |
The Watchdog log file resides at /opt/vpnadm/vpn/tmp/wdlog.
Step 6 If you want to confirm that the servers are running, issue the following command:
wdclient status
Step 7 Start the MPLS VPN Solution software VPN Console:
Proceed to the "Setting Up the Network" section.
To shut down the MPLS VPN Solution software, execute these commands:
Step 2 If the Watchdog user interface (WDGUI) is running, close it by selecting the window, right-click, then select Close from the menu.
Step 3 From the window where Watchdog was launched, close the Watchdog by issuing this command:
stopwd -y
Step 4 Log out (exit) from the vpnadm software user.
Shutting down Orbix is optional. To shut down Orbix, follow these steps:
Step 5 From the terminal window from which you launched Orbix, shut down the Name Server:
killit NS
Step 6 Discover the process ID of orbixd:
ps -ef | grep orbixd
Step 7 Shut down the Orbix process by issuing this command:
kill orbixd_process_ID
Step 8 Log out (exit) from the orbixadm software user.
To use MPLS VPN Solution to set up an MPLS VPN requires the following tasks:
1. Defining the network elements
2. Defining the Provider Administrative Domain
3. Creating the VPN customer definition
4. Defining the VPN
This chapter describes each of these MPLS VPN Solution software procedures.
There are two methods for defining targets and organizing them into the appropriate networks (or target groups):
To import router configuration files, follow these steps:
Device names within each directory must be unique.
|
Note A configuration file filename must be identical to the hostname of the router in which it resides. |
A typical set includes Provider and Customer edge routers (PEs and CEs).
Step 2 From the VPN Console menu, choose Setup > Create Targets From Router Configurations.
An informational window displays the following information:
This will create targets based on the router configuration files in a specified directory. A network will be created for the new targets.
You will be asked to enter the following information:
Step 3 Click OK.
The Create Targets From Router Configurations window displays.
Step 4 Enter the directory path, network name, and (optionally) the domain name; then click OK.
Under the Networks folder in the hierarchy pane, the product software adds the network name you specified.
Step 5 To display the window that lists the targets in a network, double-click the network name in the hierarchy pane. The product displays the Network window, as shown in Figure 3-3.
Step 2 Double-click the desired network from the list of networks.
As shown in Figure 3-3, the Network window appears in the data pane on the right, displaying the name of each router in the selected network, along with its domain name and role (in this case, Cisco Router).
At this point, you have the option to enter information for a single target (router) or multiple targets. If the targets share some characteristics, such as the same login or enable passwords, you can define those parameters once for multiple routers, then return to the Network window to edit individual targets for those parameters that are unique for each router. This is the procedure described in the following steps.
Step 3 Select the routers from the list for which you want to define the common parameters.
To select multiple targets from the list, hold down the Ctrl key while you click the desired targets.
Step 4 From the Network window, choose Actions > Edit Multiple > Edit General Parameters (as shown in Figure 3-4).
The General tab for the Edit Multiple Targets window appears.
Step 5 In this window, select the check boxes for the fields you want to apply to all the selected targets: Network, Domain, and Description.
Step 6 Choose the desired network name from the Network field drop-down list.
Step 7 Enter the domain name.
Entering information in the Description field is optional (but recommended).
Step 8 Choose the Passwords tab.
In this example, we have not specified values for the Login User and Login Password fields, reserving those values for individual router configuration.
Step 10 Specify the information for the following fields, then click OK.
a. Enable User
b. Enable Password
c. SNMP Read-Only and SNMP Read-Write community strings
|
Note The SNMP community strings must be set on all the PEs and CEs in the service provider's network; the SNMP settings on the routers must match the settings configured here. For related information, see the "Setting Up CEs for SLA Data Collection" section. |
e. SNMP and Telnet timeout
When you click OK, you return to the Network window.
Step 2 Choose Actions > Edit Target.
The Edit Target window appears (see Figure 3-7).
Defining the Passwords and SNMP Community Strings for Individual Targets
Step 3 From the Edit Target window, choose the Passwords tab.
As you can see in Figure 3-8, the fields you defined for multiple targets are displayed in the pertinent fields.
Step 4 Enter the information in the fields you need to define for the selected target (router).
Entering a Target's IP Address Information
Step 5 Choose the IP Addresses tab and click Add.
The Enter IP Address window displays.
Step 6 Enter the IP address for the selected router, then click OK.
You return to the IP Addresses tab, where the IP address you entered is now displayed.
In the event you need to add a new target (router) to an MPLS VPN network, follow these steps:
The Network window appears, displaying the names of the devices in the selected network.
Step 2 From the Network window, choose Actions>New Target.
The New Target window appears.
Step 3 Complete the fields in the General and Passwords windows as described in the "Completing the Target Information for Multiple Targets" section.
Step 4 Complete the fields for the IP Addresses as described in the "Completing the Target Information for Individual Targets" section.
When you install NetFlow on the NetFlow Collector (NFC) device, configure a local username and password. The username and password is used by MPLS VPN Solution software to communicate with the NFC.
The Network window appears, displaying the names of all the devices in the selected network.
Step 2 From the Network window, choose Actions > New Target.
The New Target window appears.
Step 3 In the Target Name field, enter the UNIX host name of the NetFlow Collector device (NFC).
Step 4 Enter the domain name for the NFC.
Step 5 Click the Role drop down menu and choose NetFlow.
|
Note Entering a description in the Description pane is not required but recommended. |
Step 6 Click the Passwords tab.
Step 7 Complete the Login User and Login Password fields as necessary.
MPLS VPN Solution uses the username and password specified here to communicate with the NFC device.
Step 8 Complete the Retries and Timeout fields as necessary.
The recommended value for Retries is 4; the recommended value for Timeout is 20 seconds.
Step 9 Choose the IP Addresses tab and click Add.
The Enter IP Address window displays.
Step 10 Enter the IP address for the selected NFC device, then click OK.
You return to the IP Addresses tab, where the IP address you entered is now displayed.
This completes the procedure for adding an NFC device to the network.
To view devices by their role, follow these steps:
The Network window appears in the data pane. By default, all the routers in the selected network are listed in the Network window.
Step 2 From the Network window, choose View > Filter by Role.
As shown in Figure 3-14, a submenu appears with two options: Cisco Router and NetFlow.
When you choose to filter the network members by either Cisco Router or NetFlow, additional information is presented, such as the login user name and login password for the NFC devices, as illustrated in Figure 3-15.
Note that a provider can also assign PEs to these Regions, thereby simplifying the PE selection process (for example, only presenting PEs in the European Region when adding service to a European customer edge router).
 |
Tips Cisco recommends that providers create one Provider Administrative Domain and then define the Regions within the PAD. |
Before you begin this procedure, have the following information at hand:
To define a new Provider Administrative Domain, follow these steps:
Step 2 Enter the name of the PAD and the BGP Autonomous System (AS) number in the appropriate fields.
The contact information is optional, but it is a good idea to provide it.
The Regions pane on the window shown in Figure 3-16 is where existing Region names are displayed. Regions must have a name, assigned PEs, and their corresponding IP address pools.
Defining a New Region in a PAD
A Region can be considered to be a group of provider edge routers (PEs) within a single BGP autonomous system.
Step 3 To begin defining a new Region, from the New Provider Administrative Domain window, click Add.
The Region window appears.
Step 4 Enter the name of the Region.
The next step in creating a Region is to assign the provider edge routers that are in the Region.
To assign the provider edge routers for the Region, follow these steps:
When you select the Add button from the Region window, the Add Provider Edge Routers window appears.
Step 2 From the window's Network drop-down list, select the appropriate service provider network name (or a network that contains provider devices).
The names of the targets (routers) in the selected service provider network are displayed.
Step 3 From the list of routers, select a router to be assigned as a PE, then click OK.
You return to the Region window. The name of the router you selected is now displayed in the list of PE Routers.
Step 4 Repeat this procedure to add additional PEs to the Region as required.
When all the provider edge routers for a Region are assigned, the next task is to assign the IP address pool for the Region (see the "Defining the IP Address Pools for a Region" section).
The Service Provider menu appears.
Step 2 From the menu, choose Open Provider A.D.
The Edit Provider Administrative Domain window appears.
Step 3 From the General tab in the window, click Add.
The Region window appears.
Step 4 In the Name field, enter the name of the Region the PE is assigned to, then click Add.
The Add Provider Edge Routers window appears (as shown in Figure 3-18).
Step 5 Select the PE (or PEs) to add to the Region, then click OK.
The MPLS VPN Solution software uses IP address pools to automatically assign IP addresses to PEs and CEs. Each Region has an IP address pool to use for IP numbered addresses (point-to-point address pool) and a separate IP address pool for IP unnumbered address (loopback address pool).
Within a VPN or extranet, all IP addresses must be unique. Customer IP addresses must not overlap with the provider's IP addresses. Overlapping IP addresses are only possible when two devices cannot see each other---that is, when they are in isolated VPNs.
 |
Caution Due to security and maintenance issues, Cisco does not recommend using customer IP addresses on the PE-CE link. |
From this window, you can add IP address pool information for point-to-point (IP numbered) links or loopback (IP unnumbered) links.
Step 2 Choose which type of address pool you are defining and click Add.
The New IP Address Pool window appears.
Step 3 Enter the address for the IP address pool and click OK.
You return to the IP Address Pools window, where the new IP address pool information is displayed.
Step 4 Click OK.
You have now created a Region in the Provider Administrative Domain. You return to the New Provider Administrative Domain window, where the new Region name is displayed in the Regions field.
To add a Region to an existing Provider Administrative Domain, follow these steps:
The list of Provider Administrative Domains are displayed.
Step 2 Select the desired Provider Administrative Domain and right-click.
The Service Provider menu appears.
Step 3 From the Service Provider menu, choose New Region.
The Region window appears, as shown in Figure 3-17.
Step 4 Complete the procedures as described in the previous sections, "Assigning the Provider Edge Routers to a Region" and "Defining the IP Address Pools for a Region."
To delete a Region from a Provider Administrative Domain, follow these steps:
Step 2 Click the desired Provider Administrative Domain's open-close icon.
The list of Regions is displayed.
Step 3 Select the desired Region, then right-click.
Step 4 From the Regions menu, choose Delete Region.
A confirmation window appears with the message, "Are you sure you want to delete this Region?"
Step 5 Click Yes.
The Region is deleted and removed from the VPN Console display.
As part of their VPN services, service providers may wish to offer premium services defined by Service Level Agreements (SLAs) to expedite traffic from certain customers or applications. Quality of Service (QoS) and its implementation through Class of Service (CoS) mechanisms in IP networks gives devices the intelligence to preferentially handle traffic as dictated by network policy.
Quality of Service (QoS) is typically used to describe a situation in which the network provides preferential treatment to certain types of traffic, but the term is not specific about exactly which mechanisms are used to provide these services.
QoS is not a device feature, it is an end-to-end system architecture. A robust QoS solution includes a variety of technologies that interoperate to deliver scalable, media-independent services throughout the network, with system-wide monitoring capabilities.
The actual deployment of QoS in a network requires a division of labor for greatest efficiency. Because QoS requires intensive processing, the Cisco model distributes CoS duties between edge and core devices. Edge devices, such as provider edge routers (PEs), do most of the processor-intensive work, performing application recognition to identify flows and classify packets according to unique customer policies. Edge devices also provide bandwidth management. Core devices expedite forwarding while enforcing CoS levels assigned at the edge.
Class of Service (Cos) is distinguished by providing differentiated classes of service. Before you can provide a higher quality of service to a customer, application, or protocol, you must classify the traffic into classes, and then determine the way in which to handle the various traffic classes as traffic moves through the network.
When differentiation is performed, it is done to identify traffic by a unique criteria and classify incoming traffic into classes. Each of the traffic classes must be recognized by the classification mechanisms at the network ingress point, as well as farther along in the network topology.
CoS differentiation is usually performed as a method of identifying traffic as it enters the network or a method that ensures that traffic is classified appropriately so that it is forced to conform with the desired user-defined policy or service-level agreement (SLA).
MPLS VPN Solution software provisions Class of Service on the ingress PE interfaces and the egress CE interfaces. MPLS VPN Solution software can apply any or all of the following CoS methods:
MPLS VPN Solution offers the following features for Class of Service (CoS) provisioning between a CE and a PE:
All three techniques rely on existing IP precedence values in all packets. Policing may change these values, but the values to differentiate the service classes must have already been set before exiting from the CE. The setting of initial IP precedence values is called painting or marking.
A Class of Service (CoS) profile represents a set of CoS configurations offered by a provider to its customer. Each CoS profile consists of a set of CoS classes that record information on how traffic shaping and policing are configured.
The MPLS VPN Solution software requires that you create a Class of Service (CoS) Profile only if you want the product to provision CoS on the PE-CE link. You can add additional CoS profiles at any time. This procedure only defines the CoS Profile---until you invoke it when you activate a service request, the CoS Profile has no effect.
Class of Service Profiles are applied to the Provider Edge Router (PE), but the CoS definition is enforced across the PE-CE link on both the PE and CE.
To define a Class of Service Profile, follow these steps:
The Service Provider menu appears.
The Service Provider menu lets you open (that is, edit) the current settings for the administrative domain, define a new Region, list the service requests active for this administrative domain, and view the current topology for that domain.
Step 2 Select Open Provider A.D.
The Edit Provider Administrative Domain window appears.
Step 3 Choose the Class of Service (CoS) Profiles tab, then click Add.
Step 4 Complete the Class of Service profile and click OK.
The PE can rate limit traffic to the subscribed bandwidth and mark the traffic that is within the specified bandwidth as in-contract, and mark traffic above the specified bandwidth as out-of-contract.
Marking a packet as in-contract or out-of-contract is done by setting the first bit of the precedence bits in the IP header. The appropriate class is indicated by the remaining two precedence bits (see Table 3-1). Traffic that exceeds any class is marked as out-of-contract, and this traffic can be dropped or mapped to a lower class of service. The out-of-contract bandwidth is initially set to the in-contract bandwidth, but you can set this to the values appropriate for the customer.
| IP Precedence | Contract Status | Class of Service |
|---|---|---|
111 | In-contract | Class 1 |
110 | In-contract | Class 2 |
101 | In-contract | Class 3 |
100 | In-contract | Class 4 |
011 | Out-of-contract | Class 1 |
010 | Out-of-contract | Class 2 |
001 | Out-of-contract | Class 3 |
000 | Out-of-contract | Class 4 |
The customer can initially "paint" the packets that leave the customer edge router (the PE is the destination router), and MPLS VPN Solution allows policing or repainting of packets that enter the provider edge router.
For more information, see the "Quality of Service and Class of Service" section.
Creating a VPN Customer Definition includes the following tasks:
To define the VPN customer information, follow these steps:
The New VPN Customer window appears.
Step 2 Enter the customer name.
Step 3 Optionally, enter the customer's contact information.
Though it is not required, entering the contact information is recommended.
For details on how to modify the VPN customer information, see the "Editing VPN Customer Information" section.
A customer site is a collection of one or more customer edge routers (CEs).
|
Note This procedure assumes the CEs in the customer site are managed by the provider. |
To define a customer site, follow these steps:
The Customer Site window appears.
Step 2 Enter the customer site name and location information.
For details on how to modify the customer site information, see the "Editing Customer Site and Site CE Definitions" section.
To assign CEs to a site, follow these steps:
Step 2 From the Add Customer Edge Routers window, select the appropriate service provider network from the Network drop-down list.
Step 3 From the list of routers displayed, select a CE in the current site.
Defining the CE as Managed or Unmanaged
MPLS VPN Solution provisions only managed CEs, thus the default is This customer edge router is managed by the provider. For more information about managed CEs and unmanaged CEs, see "Administering Customer Edge Routers."
Defining the CE's SA Agent Status
|
Note The SA Agent can gather performance information from CEs only when they are managed CEs. Make sure that when you add a CE to VPN Customer that the CE is configured as a managed CE with either Regular SA Agent status or Shadow SA Agent status enabled. |
Step 5 Indicate the CE's status regarding SA Agent.
|
Note The Management LAN and Management LAN, SA Agent options in this window allow you to define a router in service provider space as a Management CE (MCE) in a Management VPN. For information on these options, see the "Implementing the Management VPN Technique" section. |
Step 6 Repeat Steps 1 through 5 for each CE you want to add to the customer site.
Step 7 When you have added all the CEs in the site to the CE list, click OK.
You return to the Edit Customer Site window. Note that the CEs selected here are displayed in the Customer Edge Routers pane.
Step 8 Click OK.
You return to the VPN Console. Under the VPN Customers folder in the VPN Console hierarchy pane, you can view the customers defined, the sites for each customer, and the list of CEs in each site.
Step 9 Repeat the steps in "Creating a VPN Customer Definition" for each additional customer.
For information on how to modify the CE definition, see the "Editing or Viewing the Customer Edge Router Definition" section.
To edit (or view) the VPN Customer information, follow these steps:
The list of VPN customers is displayed.
Step 2 Select the name of the pertinent customer, then right-click.
Step 3 From the Customers menu, choose Open VPN Customer.
The Edit VPN Customer window appears.
You can edit the contact information by changing the information in the Contact Info panel and clicking OK.
To edit (or view) the customer site and site CE definition, follow these steps:
The list of VPN customers is displayed.
Step 2 Click the open-close icon for the pertinent VPN customer.
The list of sites for the selected customer is displayed.
Step 3 Select the appropriate site, then right-click.
The Site menu appears, as shown in Figure 3-31.
Step 4 From the Site menu, choose Open Site.
The Edit Customer Site window appears.
|
Note You can also access the Edit Customer Site window from the Edit VPN Customer window (see Figure 3-30) by selecting the pertinent Customer and clicking Edit. |
Step 5 You can edit the location information by changing the information in the Location Info panel.
|
Tips The SA Agent can gather performance information from CEs only when they are managed CEs. Make sure that when you add a CE to VPN Customer that the CE is configured as a managed CE with either Regular SA Agent status or Shadow SA Agent status enabled. |
The Edit Customer Edge Routers window appears.
Step 2 Make the changes necessary for the selected CE, then click OK.
|
Note This procedure does not implement the VPN in the network; it only defines the VPN within the MPLS VPN Solution software. |
To define the VPN, follow these steps:
Step 2 From the drop-down list, select the Provider Administrative Domain for the VPN, then click OK.
The New VPN Definition window appears.
Step 3 Enter the name of the new VPN and click OK.
You return to the VPN Console window, which now displays the new VPN name under the VPNs folder. This is all that is required to complete the VPN definition. However, you may want to define one or more CE Routing Communities for this VPN. If so, proceed to the next section.
To define a new CE Routing Community (CERC) for a VPN, follow these steps:
Step 2 From the CE Routing Communities (CERCs) tab, click Edit.
The Add CE Routing Community window appears.
|
Note CERCs should be defined only with consultation with the VPN network administrator. |
Step 3 Complete the fields as required for the VPN, then click OK.
To build complex topologies, it is necessary to break down the required connectivity between CEs into groups, where each group is either fully meshed, or has a hub and spoke pattern. A CE can be in more than one group at a time, so long as each group has one of the two basic configuration patterns.
Each subgroup in the VPN needs its own CERC. Any CE that is only in one group just joins the corresponding CERC (as a spoke if necessary). If a CE is in more than one group, then you can use the Advanced Setup choice during provisioning to add the CE to all the relevant groups in one service request. Given this information, the provisioning software does the rest, assigning route target values and VRF tables to arrange exactly the connectivity the customer requires. You can use the Topology tool to double-check the CERC memberships and resultant VPN connection status.
For more information, see the "CE Routing Communities" section.
The Management VPN technique is the default method provisioned by MPLS VPN Solution. A key concept for this implementation technique is that all the CEs in the network are a member of the management VPN. The Management VPN is a VPN that belongs to the service provider so that the service provider can manage the VPNs that belong to the provider's customers. Figure 3-38 shows a typical topology for the Management VPN technique.
A Management VPN employs two PE devices called the Management CE (MCE) and the Management PE (MPE).
| Device | Connectivity | Function |
|---|---|---|
1. Customer Edge Routers (CEs) | Access from the network management subnet into the VPNs | Provision or change configuration and collect SA Agent performance data |
2. Shadow routers | Access from the network management subnet into the VPNs | A simulated CE used to measure data travel time between two devices |
3. Provider Edge Routers (PEs) | standard IP connectivity | Provision or change configuration |
4. NetFlow Collector | standard IP connectivity | Collect data |
The MPE-MCE link uses a Management VPN (see the "Management VPN Technique" section) to connect to managed CEs. To connect to the PEs and NetFlow Connector, the MPE-MCE link uses a parallel IPv4 link.
The first step is to create a VPN Customer specifically reserved as the Management VPN Customer. The Management VPN Customer should have a single site with a single CE---the router designated as the Management CE---assigned to the Management VPN Customer's site.
To provision a management VPN in MPLS VPN Solution software, follow these steps:
You can also right-click the VPN Customers folder and choose New VPN Customer.
The New VPN Customer window appears.
Step 2 Enter the name of the Management VPN Customer. Remember that the Customer in this case is the service provider.
Step 3 Optionally, enter the contact information for the service provider network administrator.
Though it is not required, entering the contact information is recommended.
Step 4 To define the site for the Management VPN, click Add.
The Add Customer Site window appears.
Step 5 Enter the management site's name and location information.
Step 6 To add the Management CE to the management site, click Add.
The Add Customer Edge Routers window appears (see Figure 3-41).
Step 7 From the Add Customer Edge Routers window, select the name of the service provider network from the Network drop-down list.
Step 8 From the list of routers, select the router that is to function as a Management CE (MCE).
Step 9 Define the router as an MCE by choosing one of these two options, then click OK.
When you click OK, the selected router is designated as the MCE. The next step is to provision a service request between the MCE and a PE designated as the Management PE (MPE).
For detailed information on deploying service requests in the MPLS VPN Solution software, see "Defining and Deploying MPLS VPN Service Requests."
Step 10 Choose Provisioning > Add VPN Service to CE.
The introductory panel in the Add VPN Service to CE wizard appears.
Step 11 Click Next.
Step 12 From the Customer drop-down list, select the name of the Management customer.
Step 13 From the Site drop-down list, select the name of the Management site.
As shown in Figure 3-42, the name of the router designated as the MCE appears in the CE Routers pane.
Step 14 When completed with the selections, click Next.
Step 15 From the Provider drop-down list, select the name of the service provider.
Step 16 From the Region drop-down list, select the name of the Region where the MPE resides.
The list of routers in the selected Region appears in the PE Routers pane (see Figure 3-43).
Step 17 When completed with the selections, click Next.
The next window asks you to specify the routing protocol used over the MPE-MCE link.
Step 18 Choose the routing protocol used for the link between the MPE and MCE.
The recommended protocol for a Management VPN is the Routing Information Protocol (RIP).
For details about the routing protocols options available from this window, see the "Choose the Routing Protocol for the Link" section.
Step 19 Complete the information required for the selected routing protocol, then click Next.
The next window asks you to specify the protocols redistributed from the MCE.
Step 20 If protocols are to be redistributed over the MPE-MCE link, complete the necessary information, then click Next.
For details, see the "Specifying Redistributed Protocols on the Link" section.
The next window asks you to select the type of interface (WAN or LAN) and the encapsulation used on the MPE and MCE.
Step 21 Specify the interface information for the MPE-MCE link, then click Next.
a. Specify whether the MPE-MCE link is on a WAN or LAN.
b. From the PE interface panel Interface drop-down list, select the interface for the MPE.
c. From the PE interface panel Encapsulation drop-down list, select the encapsulation type for the MPE.
d. From the CE interface panel Interface drop-down list, select the interface for the MCE.
e. From the CE interface panel Encapsulation drop-down list, select the encapsulation type for the MCE.
The next window in the Add VPN Service to the CE wizard (see Figure 3-46) provides a way to define the IP addressing scheme that is appropriate for this MPE-MCE link.
Step 22 Choose the appropriate IP addressing scheme for the MPE and MCE.
Only the IP Numbered and IP Numbered with Extra CE Loopback options are valid for the MPE-MCE link.
For details on the options available on the IP Address Scheme window, see the "Choosing an IP Addressing Scheme" section.
Step 23 Enter the IP addresses for the MPE-MCE link, then click Next.
a. In the PE Interfaces fields, enter the IP address for the MPE.
b. In the CE Interfaces fields, enter the IP address for the MCE
c. If you selected the IP Numbered with Extra CE Loopback option, In the CE Loopback fields, enter the IP address for the MCE loopback address.
Step 24 In the next window, you can optionally specify the import map and maximum routes parameters for the MCE, then click Next.You can also enable NetFlow accounting on the MCE from this window.
For details on these options, see the "Specifying VRF Parameters" section.
The next window asks you to select a Class of Service (CoS) profile.
Step 25 If desired, select a CoS profile to assign to the PE-CE link, then click Next.
The next screen displays a summary of all the service settings defined for the Management VPN.
Step 26 Verify that the service request information is correct, then click Next.
The service request is assigned an ID number and submitted. This service request is now in the Requested state. For details on the states a service request moves through, see the "MPLS VPN Service Request Summary" section.
|
Note To create the Management VPN, the service request must be deployed successfully. |
Step 27 From the VPN Console, choose Provisioning > Deploy Service Requests.
The Deploy Service Requests wizard begins. For details on completing the information for completing the Deployment wizard, see the "Deploying a VPN Service" section.
When the service request is deployed successfully, MPLS VPN Solution creates the Management VPN with the name in this form:
service_provider_name_grey_mgmt_vpn
Step 2 In the CERC Memberships window, be sure to check the Join the management VPN option, as shown in Figure 3-47.
When you make the CE join the Management VPN in this step, MPLS VPN Solution generates the appropriate route-map statements in the PE's configlet.
The function of the management route map is to allow only the routes to the specific CE into the management VPN. The Cisco IOS supports only one export route map and one import route map per VRF (and therefore, per VPN).
Step 3 Complete the service request wizard as described in "Adding a Service for a PE-CE Link."
The Backup tool backs up the MPLS VPN Solution Repository, which includes all the database files, collected raw datasets, generated baseline reports, logs, service objects, and configlets, to a local directory on the MPLS VPN Solution machine. The backup options include Tar (which stands for "tape archiver" even though tape is rarely the backup medium these days) or Tar and compress.
To back up the Repository, follow these steps:
As shown in Figure 3-48, the Cisco VPN Solutions Center Repository Management Tool window appears.
Step 2 Click Backup.
The Database Backup window appears.
Step 3 In the Source Directory field, enter the path name for the Repository you want to back up.
The Source Directory field is required. This field defaults to the directory of the currently used Repository. If you choose a different Repository to back up, in this field place the full path name to the directory of the Repository that you want to back up.
Step 4 In the Destination Directory field, enter the full path name to the directory where you want to copy the Repository files.
Step 5 Determine the method you want for Repository backup by choosing one of the following:
Step 6 If you want to turn on the verbose option when backing up the database, check the Show Details check box. This option gives you detailed progress information.
Step 7 Once you have completed the fields, buttons, and boxes in the Database Backup window, click Start Backup.
|
Note Optional: To return the fields and other settings on the Database Backup window to their default values, choose Reset. |
Posted: Fri Apr 21 11:00:26 PDT 2000
Copyright 1989 - 2000©Cisco Systems Inc.