|
|
Cisco VPN Solutions Center: MPLS Solution is an MPLS VPN provisioning and auditing tool. The software focuses on the provider edge routers (PEs), customer edge routers (CEs), and the link between them. VPNSC: MPLS Solution software integrates with Cisco IP Manager for element management tasks such as downloading configlets to target routers. Additional features include Class of Service (CoS) provisioning, VPN-aware NetFlow accounting, and Service Level Agreement (SLA) monitoring.
The Cisco VPN Solutions Center (VPNSC) also provides external access to its provisioning, accounting, and SLA monitoring features through CORBA APIs.
Before you start the VPN Solutions Center software, complete these tasks:
Step 2 To keep the startup operations conveniently organized, open three terminal windows—one window for the xhost process, one for the VPN Console and Watchdog, and a third window for Orbix.
Step 3 In the first terminal window, enter the following command:
xhost VPNSC_hostname
The VPNSC_hostname parameter is the name of the VPN Solutions Center workstation. This command configures your system so that the Orbix user (orbixadm) and the MPLS VPN user (vpnadm) can communicate with your client system.
Step 2 Log in as the owner of the Orbix process (orbixadm).
su - orbixadm
When logged in, you are placed in the /opt/orbixadm directory.
Or if you are logging in remotely, enter this command:
rlogin VPNSC_hostname -l orbixadm
Step 3 Change directory to the directory where Orbix is installed.
cd orbix/Orbix3
You are now in the /opt/orbixadm/orbix/Orbix3 directory.
Step 4 Issue the following command to source the environment as required for your shell:
C-Shell: source setenvs.csh
K-Shell: . ./setenvs.sh
Step 5 Start the Orbix process in the background:
orbixd &
Step 2 Log in as the owner of the VPN Solutions Center software (vpnadm).
su - vpnadm
When logged in, you are placed in the /opt/vpnadm directory.
Or if you are logging in remotely, enter this command:
rlogin VPNSC_hostname -l vpnadm
Step 3 Go to the VPN Solutions Center installation directory.
cd vpn/
You should now be in the /opt/vpnadm/vpn directory.
Step 4 Issue the following command to source the environment as required for your shell.
C-Shell: source vpnenv.csh
K-Shell: . ./vpnenv.sh
Step 5 Set the display variable for the VPN Solutions Center workstation.
For the C shell:
setenv DISPLAY VPNSC_hostname:0.0
For the K shell:
export DISPLAY=VPNSC_hostname:0.0
Step 6 Start the application's WatchDog processes:
startwd
To stop the WatchDog process, issue the stopwd -y command.
The WatchDog log file is located at /opt/vpnadm/vpn/tmp/wdlog.
Step 7 If you would like to confirm that the servers are running, issue the following command:
wdclient status
 |
Note This command is recommended, but it is not a required command in the startup sequence. |
If you would prefer to bring up the WatchDog graphical user interface, issue this command:
wdgui &
The WatchDog interface appears (see Figure 3-1):
For a detailed description of the WatchDog graphical user interface, refer to the "wdgui Command" section in Chapter 2, "WatchDog Commands," of the Cisco VPN Solutions Center: MPLS Solution User Reference.
Step 8 Issue the following command to start the VPN Console:
vpnconsole &
The VPN Solutions Center Security dialog box appears (see Figure 3-2).
Step 9 Enter a valid user name and password, then click OK.
The default username is admin. The default password is admin.
The VPN Solutions Center VPN Console appears, as illustrated in Figure 3-3.
Proceed to the "Setting Up the Network" section.
Step 2 If the Watchdog user interface (wdgui) is running, close it by selecting the window, right-click, then choose Close from the menu.
Step 3 From the window where Watchdog was launched, close the Watchdog by issuing this command:
stopwd -y
Step 4 Log out (exit) from the vpnadm user.
Shutting down Orbix is optional. To shut down Orbix, follow these steps:
Step 5 From the terminal window from which you launched Orbix, shut down the Name Server:
killit NS
Step 6 Discover the process ID of orbixd:
ps -ef | grep orbixd
Step 7 Shut down the Orbix process by issuing this command:
kill orbixd_process_ID
Step 8 Log out (exit) from the orbixadm user.
To use VPNSC: MPLS Solution to set up an MPLS VPN network requires the following tasks:
1. Define the network elements.
2. Define the Provider Administrative Domain.
3. Create a VPN customer definition for each VPN customer.
4. Define a VPN.
5. If you are using a management VPN to manage your customers' VPNs, define a management VPN.
|
Note When you define target names in the VPN Solutions Center software, the target names you specify must match the actual IOS host names of the corresponding devices. |
|
Note The Simple Network Management Protocol (SNMP) must be configured on each PE router and CE router in the service provider network. To determine whether SNMP is enabled and set the SNMP community strings on a router, see the "Setting Up SNMP on the Routers in the Service Provider Network" section. |
There are two methods for defining targets and organizing them into the appropriate networks (or target groups):
To import router configuration files, follow these steps:
Device names within each directory must be unique.
A typical set includes Provider and Customer edge routers (PEs and CEs).
Step 2 From the VPN Console menu, choose Setup > Create Targets From Router Configurations.
An informational window displays the following information:
This will create targets based on the router configuration files in a specified directory. A network will be created for the new targets.
You will be asked to enter the following information:
Step 3 Click OK.
The Create Targets From Router Configurations dialog box appears (see Figure 3-4).
Step 4 Enter the directory path, network name, and (optionally) the domain name; then click OK.
a. The directory path is the path to the router configuration files.
b. The Network Name field includes a drop-down list that provides all the currently defined networks. To select the network name from the list, click the Down Arrow icon, then select the appropriate network name.
c. The domain name indicates the service provider's domain.
 |
Caution It is important to understand that when you specify both the domain name of a device and the IP address of a device, the IP address overrides the specified domain name. |
Under the Networks folder in the hierarchy pane, the product software adds the network name you specified.
Step 5 To display the window that lists the targets in a network, double-click the network name in the hierarchy pane. The product displays the Network window, as shown in Figure 3-5.
To find a specific network, follow these steps:
The Find dialog box appears with the category Network already selected (see Figure 3-6).
Step 2 In the Find What field, enter the name of the network you want to find.
Step 3 If you want the search to match the case of the network name you enter, check the Match Case check box.
Step 4 Choose the direction of the search by clicking the Up or Down radio button.
Step 5 When you have completed the search parameters, click Find Next.
The VPNSC software locates the indicated network and highlights it in the hierarchy pane, as shown in Figure 3-7.
Step 6 Close the Find window.
Step 2 Double-click the desired network from the list of networks.
As shown in Figure 3-5, the Network window appears in the data pane on the right, displaying the name of each router in the selected network, along with its domain name and role (in this case, Cisco Router).
At this point, you have the option to enter information for a single target (router) or multiple targets. If the targets share some characteristics, such as the same login or enable passwords, you can define those parameters once for multiple routers, then return to the Network window to edit individual targets for those parameters that are unique for each router. This is the procedure described in the following steps.
Step 3 Select the routers from the list for which you want to define the common parameters.
To select multiple targets from the list, hold down the Ctrl key while you click the desired targets.
Step 4 From the Network window, choose Actions > Edit Multiple > Edit General Parameters (as shown in Figure 3-8).
The General tab for the Edit Multiple Targets dialog box appears (see Figure 3-9).
Step 5 In this dialog box, select the check boxes for the fields you want to apply to all the selected targets: Network, Domain, and Description.
Step 6 Choose the desired network name from the Network field drop-down list.
Step 7 Enter the domain name.
|
Caution When you specify both the domain name of the device and the IP address of a device, the IP address overrides the specified domain name. |
Entering information in the Description field is optional (but recommended).
Step 8 Choose the Passwords tab (as shown in Figure 3-10).
In this example, we have not specified a value for the Login User field, reserving that value for individual router configuration.
Step 10 Specify the information for the following fields, then click OK.
a. Login Password
b. Enable User
c. Enable Password
d. SNMP Read-Only and SNMP Read-Write community strings
|
Note The SNMP community strings must be set on all the PEs and CEs in the service provider's network; the SNMP settings on the routers must match the settings configured here. For related information, see the "Setting Up SNMP on the Routers in the Service Provider Network" section. |
f. SNMP and Telnet timeout
When you click OK, you return to the Network window.
|
Caution It is important to understand that when you specify both the domain name of the device and the IP address of a device, the IP address overrides the specified domain name. |
Step 2 Choose Actions > Edit Target.
The Edit Target dialog box appears (see Figure 3-11).
Defining the Passwords and SNMP Community Strings for Individual Targets
Step 3 From the Edit Target dialog box, choose the Passwords tab (see Figure 3-12).
As you can see in Figure 3-12, the fields you defined for multiple targets are displayed in the pertinent fields.
Step 4 Enter the information in the fields you need to define for the selected target (router).
|
Caution VPNSC: MPLS Solution requires that the PEs and managed CEs in the network have a virtual terminal (login) password. The data collection operation fails if VPNSC does not find the login password set on a router it is collecting data from. If you have not yet set the login password on the router and in this dialog box, please do so now. |
Entering a Target's IP Address Information
|
Caution When you specify both the domain name of a device and the IP address of a device, the IP address overrides the specified domain name. |
Step 5 Choose the IP Addresses tab and click Add.
The Enter IP Address dialog box appears (see Figure 3-13).
Step 6 Enter the IP address for the selected router, then click OK.
You return to the IP Addresses tab, where the IP address you entered is now displayed.
To change the passwords defined for routers in the VPNSC software, follow these steps:
Step 2 Double-click the desired network from the list of networks.
The Network window appears in the data pane on the right, displaying the name of each router in the selected network, along with its domain name and role (in this case, Cisco Router).
At this point, you have the option to change the passwords for a single target (router) or multiple targets. This procedure describes how to change the passwords for multiple routers at once.
Step 3 Select the routers from the list for which you want to change one or more passwords.
To select multiple targets from the list, hold down the Ctrl key while you click the desired targets.
Step 4 From the Network window, choose Actions > Edit Multiple > Edit Existing Passwords. The Edit Multiple Targets dialog box appears (see Figure 3-14).
Step 5 Check the checkboxes for the password(s) you want to change, then enter the new passwords.
Step 6 When the changes are complete, click OK.
In the event you need to add a new target (router) to an MPLS VPN network, follow these steps:
Step 2 Double-click the selected network.
The Network window appears, displaying the names of the devices in the selected network.
Step 3 From the Network window, choose Actions>New Target. The New Target dialog box appears (see Figure 3-15).
Step 4 Complete the fields in the General and Passwords dialog boxes as described in the "Completing the Target Information for Multiple Targets" section.
Step 5 Complete the fields for the IP Addresses as described in the "Completing the Target Information for Individual Targets" section.
When you install NetFlow on the NetFlow Collector (NFC) device, configure a local username and password. The username and password is used by VPNSC: MPLS Solution software to communicate with the NFC.
The Network window appears, displaying the names of all the devices in the selected network.
Step 2 From the Network window, choose Actions > New Target. The New Target dialog box appears (see Figure 3-16).
Step 3 In the Target Name field, enter the UNIX host name of the NetFlow Collector device (NFC).
|
Note When you define target names in VPN Solutions Center software, it is important that the target names you specify match the actual IOS host names of the corresponding devices. |
Step 4 Enter the domain name for the NFC device.
|
Caution It is important to understand that when you specify both the domain name of a device and the IP address of a device, the IP address overrides the specified domain name. |
Step 5 Click the Role drop-down menu, then choose NetFlow.
|
Note Entering a description in the Description pane is not required but recommended. |
Step 6 Click the Passwords tab (see Figure 3-17).
Step 7 Complete the Login User and Login Password fields as necessary.
VPNSC: MPLS Solution uses the username and Login password specified here to communicate with the NFC device. The Login password is a required password—this password must be set both on the router and in VPNSC.
Step 8 Complete the Retries and Timeout fields as necessary.
The recommended value for Retries is 4; the recommended value for Timeout is 20 seconds.
Step 9 Choose the IP Addresses tab and click Add.
The Add IP Address dialog box appears (see Figure 3-18).
|
Caution It is important to understand that when you specify both the domain name of the device and the IP address of the device, the IP address overrides the specified domain name. |
Step 10 Enter the IP address for the selected NFC device, then click OK.
You return to the IP Addresses tab, where the IP address you entered is now displayed.
This completes the procedure for adding an NFC device to the network.
To view devices by their role, follow these steps:
The Network window appears in the data pane. By default, all the routers in the selected network are listed in the Network window.
Step 2 From the Network window, choose View > Filter by Role.As shown in Figure 3-19, a submenu appears with two options: Cisco Router and NetFlow.
Note that a provider can also assign PEs to these Regions, thereby simplifying the PE selection process (for example, only presenting PEs in the European Region when adding service to a European customer edge router).
 |
Tips Cisco recommends that providers create one Provider Administrative Domain and then define the Regions within the PAD. |
Before you begin this procedure, have the following information at hand:
To define a new Provider Administrative Domain, follow these steps:
The New Provider Administrative Domain dialog box appears (see Figure 3-21).
Step 2 Enter the name of the PAD and the BGP Autonomous System (AS) number in the appropriate fields.
The contact information is optional, but it is a good idea to provide it.
The Regions pane on the dialog box shown in Figure 3-21 is where existing Region names are displayed. Regions must have a name, assigned PEs, and their corresponding IP address pools.
Defining a New Region in a PAD
A Region can be considered to be a group of provider edge routers (PEs) within a single BGP autonomous system.
Step 3 To begin defining a new Region, from the New Provider Administrative Domain dialog box, click Add.
The Region dialog box appears (see Figure 3-22).
Step 4 Enter the name of the Region.
The next step in creating a Region is to assign the provider edge routers that are in the Region.
To assign the provider edge routers for the Region, follow these steps:
When you select the Add button from the Region dialog box, the Add Provider Edge Routers dialog box appears.
Step 2 From the dialog box's Network drop-down list, select the appropriate service provider network name (or a network that contains provider devices).
The names of the targets (routers) in the selected service provider network are displayed (see Figure 3-23).
Step 3 From the list of routers, select a router to be assigned as a PE, then click OK.
You return to the Region dialog box. The name of the router you selected is now displayed in the list of PE Routers.
Step 4 Repeat this procedure to add additional PEs to the Region as required.
When all the provider edge routers for a Region are assigned, the next task is to assign the IP address pool for the Region (see the "Defining the IP Address Pools for a Region" section).
Step 2 From the PAD menu, choose Open Provider A.D.
The Edit Provider Administrative Domain dialog box appears (see Figure 3-25).
Step 3 From the list of Regions, choose the Region to which the PE is to be added.
Step 4 Click Edit. The Region dialog box appears (see Figure 3-26).
Step 5 From the Region dialog box, click Add.
Step 6 In the Add Provider Edge Routers dialog box, do the following:
a. From the Network drop-down list, choose the network.
b. From the list of devices, choose the name of the router you want to add as a PE.
c. Click OK.
You return to the Region dialog box, where you can see, as shown in Figure 3-28, that the selected router has been added to the list of PE Routers in the Region.
Step 7 To complete the operation, click OK. You return to the Edit Provider Administrative Domain dialog box.
Click OK again to return to the VPN Console.
To find a specific VPN service provider, follow these steps:
The Find dialog box appears with the category VPN Provider already selected, as shown in Figure 3-29.
Step 2 In the Find What field, enter the name of the VPN Provider you want to find.
Step 3 If you want the search to match the case of the VPN Provider name you enter, check the Match Case check box.
Step 4 Choose the direction of the search by clicking the Up or Down radio button.
Step 5 When you have completed the search parameters, click Find Next.
The VPNSC software locates the indicated VPN Provider and highlights it in the hierarchy pane.
The VPNSC: MPLS Solution software uses IP address pools to automatically assign IP addresses to PEs and CEs. Each Region has an IP address pool to use for IP numbered addresses (point-to-point address pool) and a separate IP address pool for IP unnumbered address (loopback address pool).
Within a VPN or extranet, all IP addresses must be unique. Customer IP addresses must not overlap with the provider's IP addresses. Overlapping IP addresses are only possible when two devices cannot see each other—that is, when they are in isolated VPNs.
|
Caution Due to security and maintenance issues, Cisco does not recommend using customer IP addresses on the PE-CE link. |
From this dialog box, you can add IP address pool information for point-to-point (IP numbered) links or loopback (IP unnumbered) links.
Step 2 Choose which type of address pool you are defining and click Add. The New IP Address Pool dialog box appears (see Figure 3-31).
Step 3 Enter the address for the IP address pool and click OK.
You return to the IP Address Pools dialog box, where the new IP address pool information is displayed.
Step 4 Click OK.
You return to the New Provider Administrative Domain dialog box, where the new Region name is displayed in the Regions field.
MPLS-based VPNs employ BGP to communicate between PEs to facilitate customer routes. This is made possible through extensions to BGP that carry addresses other than IPv4 addresses. A notable extension is called the route distinguisher (RD).
The purpose of the route distinguisher (RD) is to make the prefix value unique across the network backbone. Prefixes should use the same RD if they are associated with the same set of route targets (RTs) and anything else that is used to select routing policy. The community of interest association is based on the route target (RT) extended community attributes distributed with the Network Layer Reachability Information (NLRI).The RD value must be a globally unique value to avoid conflict with other prefixes.
The MPLS label is part of a BGP routing update. The routing update also carries the addressing and reachability information. When the RD is unique across the MPLS VPN network, proper connectivity is established even if different customers use non-unique IP addresses.
For the RD, every CE that has the same overall role should use a VRF with the same name, same RD, and same RT values. The RDs and RTs are only for route exchange between the PEs running BGP. That is, for the PEs to do MPLS VPN work, they have to exchange routing information with more fields than usual for IPv4 routes; that extra information includes (but is not limited to) the RDs and RTs.
VPNSC: MPLS Solution software sets the route distinguisher and route target values, but you can assign your own values if you choose (as described in this section).
You can also override the default RD value set by the VPN Solutions Center software. For instructions, see the "Overriding the Default VRF Name and Route Distinguisher Values" section.
|
Note You can change the RD and RT values with the VPNSC: MPLS Solution software for a given Provider Administrative Domain (PAD) only when creating a new PAD. You cannot edit the RD and RT values once they are initially set. |
By default, the product software assigns the RD values as follows:
bgp_AS:value.
bgp_AS:value + 1
Each spoke uses its own RD value for proper hub and spoke connectivity between CEs; therefore, the VPNSC: MPLS Solution software implements a new RD for each spoke that is provisioned.
To assign the Route Distinguisher or Route Target values, follow these steps:
The New PAD Advanced dialog box appears (see Figure 3-32), which allows you to alter the default Route Distinguisher and Route Target values.
Step 2 In the Start Route Distinguisher Values At <BGP AS#> field, enter the new Route Distinguisher value.
Step 3 In the Start Route Target Values At <BGP AS#> field, enter the new Route Target value.
Step 4 Click OK.
To add a Region to an existing Provider Administrative Domain, follow these steps:
The list of Provider Administrative Domains is displayed.
Step 2 Select the desired Provider Administrative Domain and right-click. The PAD menu appears (see Figure 3-33).
Step 3 From the PAD menu, choose New Region. The Region dialog box appears, as shown in Figure 3-22.
Step 4 Complete the procedures as described in the previous sections, "Assigning the Provider Edge Routers to a Region" and "Defining the IP Address Pools for a Region."
Only a Region without any active service requests associated with that Region can be deleted.
To delete a Region from a Provider Administrative Domain, follow these steps:
Step 2 Click the desired Provider Administrative Domain's open-close icon.
The list of Regions is displayed.
Step 3 Select the desired Region, then right-click.
Step 4 From the Regions menu, choose Delete Region.
A confirmation window appears with the message, "Are you sure you want to delete this Region?"
Step 5 Click Yes.
The Region is deleted and removed from the VPN Console display.
To find a specific region, follow these steps:
The Find dialog box appears with the category Provider Region already selected, as shown in Figure 3-34).
Step 2 In the Find What field, enter the name of the Region you want to find.
Step 3 If you want the search to match the case of the Region name you enter, check the Match Case check box.
Step 4 Choose the direction of the search by clicking the Up or Down radio button.
Step 5 When you have completed the search parameters, click Find Next.
The VPNSC software locates the indicated Region and highlights it in the hierarchy pane.
Step 6 Close the Find dialog box.
This section provides an overview of main features for viewing the Provider Administrative Domains topology. This section does not describe all the topology features in detail. For details on each of the menus and options available from the Topology window, refer to "Topology" in Chapter 10 of the VPN Solutions Center: MPLS Solution User Reference.
To display the topology for a particular Provider Administrative Domain, follow these steps:
Step 2 From the PAD menu, choose Show Topology.
The VPNSC software displays the current top-level topology for the selected Provider Administrative Domain (see Figure 3-35).
Step 3 Use the functions and features in the Topology windows to view various aspects of the PAD topology.
When you open the folders in the hierarchy pane, you can see the names of the PEs, the Regions, and the Service Provider with whom they are associated (see Figure 3-36).
Step 2 To sort the list in ascending order, choose Sort > Ascending; to sort the list in descending order, choose Sort > Descending.
You can view and retrieve various details concerning the Regions and PEs in a specific PAD.
The Node menu presents the following options:
Step 2 Choose the options you need from the Node menu.
As part of their VPN services, service providers may wish to offer premium services defined by Service Level Agreements (SLAs) to expedite traffic from certain customers or applications. Quality of Service (QoS) and its implementation through Class of Service (CoS) mechanisms in IP networks gives devices the intelligence to preferentially handle traffic as dictated by network policy.
Quality of Service (QoS) is typically used to describe a situation in which the network provides preferential treatment to certain types of traffic, but the term is not specific about exactly which mechanisms are used to provide these services.
QoS is not a device feature, it is an end-to-end system architecture. A robust QoS solution includes a variety of technologies that interoperate to deliver scalable, media-independent services throughout the network, with system-wide monitoring capabilities.
The actual deployment of QoS in a network requires a division of labor for greatest efficiency. Because QoS requires intensive processing, the Cisco model distributes CoS duties between edge and core devices. Edge devices, such as provider edge routers (PEs), do most of the processor-intensive work, performing application recognition to identify flows and classify packets according to unique customer policies. Edge devices also provide bandwidth management. Core devices expedite forwarding while enforcing CoS levels assigned at the edge.
Class of Service (Cos) is distinguished by providing differentiated classes of service. Before you can provide a higher quality of service to a customer, application, or protocol, you must classify the traffic into classes, and then determine the way in which to handle the various traffic classes as traffic moves through the network.
When differentiation is performed, it is done to identify traffic by a unique criteria and classify incoming traffic into classes. Each of the traffic classes must be recognized by the classification mechanisms at the network ingress point, as well as farther along in the network topology.
CoS differentiation is usually performed as a method of identifying traffic as it enters the network or a method that ensures that traffic is classified appropriately so that it is forced to conform with the desired user-defined policy or service-level agreement (SLA).
VPNSC: MPLS Solution software provisions Class of Service on the ingress PE interfaces and the egress CE interfaces. VPNSC: MPLS Solution offers the following features for Class of Service (CoS) provisioning between a CE and a PE:
All three techniques rely on existing IP precedence values in all packets. Policing may change these values, but the values to differentiate the service classes must have already been set before exiting from the CE. The setting of initial IP precedence values is called painting or marking.
A Class of Service (CoS) profile represents a set of CoS configurations offered by a provider to its customer. Each CoS profile consists of a set of CoS classes that record information on how traffic shaping and policing are configured.
The VPNSC: MPLS Solution software requires that you create a Class of Service (CoS) Profile only if you want the product to provision CoS on the PE-CE link. You can add additional CoS profiles at any time. This procedure only defines the CoS Profile—until you invoke it when you activate a service request, the CoS Profile has no effect.
Class of Service Profiles are applied to the Provider Edge Router (PE), but the CoS definition is enforced across the PE-CE link on both the PE and CE.
To define a Class of Service Profile, follow these steps:
The PAD menu lets you open (that is, edit) the current settings for the administrative domain, define a new Region, list the service requests active for this administrative domain, and view the current topology for that domain.
Step 2 Choose Open Provider A.D.
The Edit Provider Administrative Domain dialog box appears.
Step 3 Choose the Class of Service (CoS) Profiles tab, then click Add.
The New Class of Service Profile dialog box appears (see Figure 3-41).
Step 4 Complete the Class of Service profile, then click OK.
The PE can rate limit traffic to the subscribed bandwidth and mark the traffic that is within the specified bandwidth as in-contract, and mark traffic above the specified bandwidth as out-of-contract.
Marking a packet as in-contract or out-of-contract is done by setting the first bit of the precedence bits in the IP header. The appropriate class is indicated by the remaining two precedence bits (see Table 3-1). Traffic that exceeds any class is marked as out-of-contract, and this traffic can be dropped or mapped to a lower class of service. The out-of-contract bandwidth is initially set to the in-contract bandwidth, but you can set this to the values appropriate for the customer.
| IP Precedence | Contract Status | Class of Service |
|---|---|---|
111 | In-contract | Class 1 |
110 | In-contract | Class 2 |
101 | In-contract | Class 3 |
100 | In-contract | Class 4 |
011 | Out-of-contract | Class 1 |
010 | Out-of-contract | Class 2 |
001 | Out-of-contract | Class 3 |
000 | Out-of-contract | Class 4 |
The customer can initially "paint" the packets that leave the customer edge router (the PE is the destination router), and VPNSC: MPLS Solution allows policing or repainting of packets that enter the provider edge router.
For more information, see the "Quality of Service and Class of Service" section.
The Backup tool backs up the VPN Solutions Center Repository, which includes all the database files, collected raw datasets, generated baseline reports, logs, service objects, and configlets, to a local directory on the VPNSC: MPLS Solution machine. The backup options include Tar (which stands for "tape archiver" even though tape is rarely the backup medium these days) or Tar and compress.
To back up the Repository, follow these steps:
The Cisco VPN Solutions Center Repository Management Tool window appears (see Figure 3-42).
Step 2 Click Backup.
The Database Backup dialog box appears (see Figure 3-43).
Step 3 In the Source Directory field, enter the path name for the Repository you want to back up.
The Source Directory field is required. This field defaults to the directory of the currently used Repository. If you choose a different Repository to back up, in this field place the full path name to the directory of the Repository that you want to back up.
Step 4 In the Destination Directory field, enter the full path name to the directory where you want to copy the Repository files.
Step 5 Determine the method you want for Repository backup by choosing one of the following:
Step 6 If you want to turn on the verbose option when backing up the database, check the Show Details check box. This option gives you detailed progress information.
Step 7 Once you have completed the fields, buttons, and boxes in the Database Backup dialog box, click Start Backup.
|
Note Optional: To return the fields and other settings on the Database Backup dialog box to their default values, choose Reset. |
To restore the Repository, follow these steps:
As shown in Figure 3-42, the Cisco VPN Solutions Center Repository Management Tool page appears.
Step 2 Shut down the VPN Console by choosing File > Exit.
Shutting down the VPN Console prevents other processes from writing to the Repository during the restoration process.
Step 3 Choose Restore. The Database Restore dialog box appears (see Figure 3-44).
Step 4 In the Source Directory/File field, enter the directory (or path to a filename) from which you are restoring the Repository.
Step 5 In the Destination Directory field, enter the drive and path to the directory where you want to restore the Repository.
|
Caution The destination directory for the restoration operation must be empty. If you restore a Repository over an existing Repository, valuable data may be lost and service requests may not function correctly. |
Step 6 Set the Restore operation options if desired:
Step 7 When you have completed the fields, click Restore.
You receive the prompt, "Do you really want to continue?"
Step 8 To proceed with the Repository restoration operation, click OK.
The next page provides the following information:
The Database Restore Process has started! The Database backup file is path/filename. Restore to directory pathname. The execution string is dbRestore source_path ~dest destination_path -c Click here to look at the Status.
Step 9 To check the status of the Restore operation, choose the Status link.
The Cisco VPNSC Repository Management Tool displays the Status page.
The Simple Network Management Protocol (SNMP) must be configured on each PE router and CE router in the service provider network. To determine whether SNMP is enabled and set the SNMP community strings on a router, execute the following steps for each router.
Step | Command | Description or Task |
1 |
|
|
2 |
|
|
3 |
| |
4 |
| |
5 |
|
|
6 |
|
|
7 |
|
|
8 |
|
|
9 |
|
|
|
Tips The SNMP strings defined in the VPNSC: MPLS Solution target password database must agree with those set on each router in the service provider network. The procedure for setting the SNMP community strings in the VPNSC: MPLS Solution software is described in the "Completing the Target Information for Individual Targets" section. |
Posted: Wed Sep 20 14:57:03 PDT 2000
Copyright 1989-2000©Cisco Systems Inc.