|
|
This chapter describes how to create and provision MPLS VPNs using the VPNSC software. The main topics presented in this chapter are as follows:
Creating a VPN Customer Definition includes the following tasks:
To define the VPN customer information, follow these steps:
Step 2 Enter the customer name.
Step 3 Optionally, enter the customer's contact information.
Though it is not required, entering the contact information is recommended.
For details on how to modify the VPN customer information, see the "Editing VPN Customer Information" section.
A customer site is a collection of one or more customer edge routers (CEs).
 |
Note This procedure assumes the CEs in the customer site are managed by the provider. |
To define a customer site, follow these steps:
The Customer Site dialog box appears (see Figure 4-2).
Step 2 Enter the customer site name and location information.
For details on how to modify the customer site information, see the "Editing Customer Site and Site CE Definitions" section.
To find a specific Customer site, follow these steps:
The Find dialog box appears with the category Customer Site already selected (see Figure 4-3).
Step 2 In the Find What field, enter the name of the Customer site you want to find.
Step 3 If you want the search to match the case of the Customer site name you enter, check the Match Case check box.
Step 4 Choose the direction of the search by clicking the Up or Down radio button.
Step 5 When you have completed the search parameters, click Find Next.
The VPNSC software locates the indicated Customer site and highlights it in the hierarchy pane.
Step 6 Close the Find dialog box.
To assign CEs to a site, follow these steps:
Step 2 From the Add Customer Edge Routers dialog box, select the appropriate service provider network from the Network drop-down list (see Figure 4-4).
Step 3 From the list of routers displayed, select a CE in the current site.
Defining the CE as Managed or Unmanaged
VPNSC: MPLS Solution provisions only managed CEs, thus the default is This customer edge router is managed by the provider. For more information about managed CEs and unmanaged CEs, see "Administering Customer Edge Routers."
|
Note If configuring a service for a cable link, the CE should be configured as an unmanaged CE. |
Defining the CE's SA Agent Status
 |
Tips The SA Agent can gather performance information from CEs only when they are managed CEs. Make sure that when you add a CE to VPN Customer that the CE is configured as a managed CE with either Regular SA Agent status or Shadow SA Agent status enabled. |
Step 5 Indicate the CE's status regarding SA Agent.
|
Note The Management LAN and Management LAN, SA Agent options in this dialog box allow you to define a router in service provider space as a Management CE (MCE) in a Management VPN. For information on these options, see the "Implementing the Management VPN Technique" section. |
Step 6 Repeat Steps 1 through 5 for each CE you want to add to the customer site.
Step 7 When you have added all the CEs in the site to the CE list, click OK.
You return to the Edit Customer Site dialog box. Note that the CEs selected here are displayed in the Customer Edge Routers pane.
Step 8 Click OK.
You return to the VPN Console. Under the VPN Customers folder in the VPN Console hierarchy pane, you can view the customers defined, the sites for each customer, and the list of CEs in each site.
Step 9 Repeat the steps in "Creating a VPN Customer Definition" section" for each additional customer.
For information on how to modify the CE definition, see the "Editing or Viewing the Customer Edge Router Definition" section.
To edit (or view) the VPN Customer information, follow these steps:
The list of VPN customers is displayed.
Step 2 Select the name of the pertinent customer, then right-click.
Step 3 From the Customers menu, choose Open VPN Customer.
The Edit VPN Customer dialog box appears.
You can edit the contact information by changing the information in the Contact Info panel and clicking OK.
To find a specific VPN Customer, follow these steps:
The Find dialog box appears with the category VPN Customer already selected (see Figure 4-7).
Step 2 In the Find What field, enter the name of the VPN Customer you want to find.
Step 3 If you want the search to match the case of the VPN Customer name you enter, check the Match Case check box.
Step 4 Choose the direction of the search by clicking the Up or Down radio button.
Step 5 When you have completed the search parameters, click Find Next.
The VPNSC software locates the indicated VPN Customer and highlights it in the hierarchy pane.
Step 6 Close the Find dialog box.
To edit (or view) the customer site and site CE definition, follow these steps:
The list of VPN customers is displayed.
Step 2 Click the open-close icon for the pertinent VPN customer.
The list of sites for the selected customer is displayed.
Step 3 Select the appropriate site, then right-click.
The Site menu appears, as shown in Figure 4-8.
Step 4 From the Site menu, choose Open Site.
The Edit Customer Site dialog box appears (see Figure 4-9).
|
Note You can also access the Edit Customer Site dialog box from the Edit VPN Customer dialog box (see Figure 4-6) by selecting the pertinent Customer and clicking Edit. |
Step 5 You can edit the location information by changing the information in the Location Info panel.
|
Tips The SA Agent can gather performance information from CEs only when they are managed CEs. Make sure that when you add a CE to VPN Customer that the CE is configured as a managed CE with either Regular SA Agent status or Shadow SA Agent status enabled. |
The Edit Customer Edge Routers dialog box appears (see Figure 4-10).
Step 2 Make the changes necessary for the selected CE, then click OK.
This section provides an overview of main features for viewing VPN Customer topologies. This section does not describe all the topology features in detail. For details on each of the menus and options available from the Topology window, refer to "Topology" in Chapter 10 of the VPN Solutions Center: MPLS Solution User Reference.
To display the topology for a particular VPN Customer, follow these steps:
Step 2 From the Customer menu, choose Show Topology.
The VPNSC software displays the current top-level topology for the selected VPN Customer (see Figure 4-12).
Step 3 Use the functions and features in the Topology window to view various aspects of the VPN Customer topology.
To view the sites and CEs in each site, open the folders in the hierarchy pane as shown in Figure 4-13.
You can view and retrieve various details concerning the sites and the PAD for a selected VPN Customer.
The Node menu presents the following options:
Step 2 Choose the options you need from the Node menu.
|
Note This procedure does not implement the VPN in the network; it only defines the VPN within the VPNSC: MPLS Solution software. |
To define the VPN, follow these steps:
Step 2 From the drop-down list in the Select Provider Administrative Domain dialog box (as shown in Figure 4-16), select the Provider Administrative Domain for the VPN, then click OK.
The New VPN Definition dialog box appears (see Figure 4-17).
Step 3 Enter the name of the new VPN and click OK.
You return to the VPN Console window, which now displays the new VPN name under the VPNs folder. This is all that is required to complete the VPN definition. However, you may want to define one or more CE Routing Communities for this VPN. If so, proceed to the next section.
To find a specific VPN, follow these steps:
The Find dialog box appears with the category VPN already selected (see Figure 4-18).
Step 2 In the Find What field, enter the name of the VPN you want to find.
Step 3 If you want the search to match the case of the VPN name you enter, check the Match Case check box.
Step 4 Choose the direction of the search by clicking the Up or Down radio button.
Step 5 When you have completed the search parameters, click Find Next.
The VPNSC software locates the indicated VPN and highlights it in the hierarchy pane.
Step 6 Close the Find dialog box.
For more information, see the "CE Routing Communities" section.
To define a new CE Routing Community (CERC) for a VPN, follow these steps:
Step 2 From the CE Routing Communities (CERCs) tab, click Add.
The Add CE Routing Community dialog box appears.
|
Note CERCs should be defined only with consultation with the VPN network administrator. |
Step 3 Complete the fields as required for the VPN, then click OK.
To build complex topologies, it is necessary to break down the required connectivity between CEs into groups, where each group is either fully meshed, or has a hub and spoke pattern. A CE can be in more than one group at a time, so long as each group has one of the two basic configuration patterns.
Each subgroup in the VPN needs its own CERC. Any CE that is only in one group just joins the corresponding CERC (as a spoke if necessary). If a CE is in more than one group, then you can use the Advanced Setup choice during provisioning to add the CE to all the relevant groups in one service request. Given this information, the provisioning software does the rest, assigning route target values and VRF tables to arrange exactly the connectivity the customer requires. You can use the Topology tool to double-check the CERC memberships and resultant VPN connection status.
The list of VPNs is displayed.
Step 2 Select the VPN that the CERC is defined in, then right-click.
The VPN menu appears (see Figure 4-21).
Step 3 Choose Open VPN.
The Edit VPN Definition dialog box appears.
Step 4 Choose the CE Routing Communities (CERCs) tab.
The dialog box shown in Figure 4-22 appears.
Step 5 To add a CERC to the currently selected VPN, click Add.
The Add CE Routing Community dialog box appears (see Figure 4-23).
Step 6 Enter the name of the CERC; then set the CERC type.
Step 7 When you have finished entering the information in the Add CE Routing Community dialog box, click OK.
The new CERC is added to the VPN definition.
You cannot delete a CERC from the VPNSC software if there are active service requests using the CERC.
To delete a CERC definition, follow these steps:
The list of VPNs is displayed.
Step 2 Select the VPN that the CERC is defined in, then right-click.
The VPN menu appears (see Figure 4-21).
Step 3 Choose Open VPN.
The Edit VPN Definition dialog box appears.
Step 4 Choose the CE Routing Communities (CERCs) tab (see Figure 4-22
Step 5 To delete a CERC from the currently selected VPN, click Delete.
If the CERC you wish to delete has active service requests, you receive a warning that the CERC is not deletable.
Step 6 Click OK.
This section provides an overview of main features of the topology feature for VPNs. This section does not describe all the topology features in detail. For details on each of the menus and options available from the Topology window, refer to "Topology" in Chapter 10 of the VPN Solutions Center: MPLS Solution User Reference.
To display the topology for a particular VPN, follow these steps:
Step 2 From the VPN menu, choose Show Topology.
The VPNSC software displays the current top-level topology for the selected VPN (see Figure 4-24).
The hierarchy pane (on the left) shows the folders for the VPN's components: the hubs, the CEs, and the CERCs.
Step 3 Use the functions and features in the Topology windows view various aspects of the VPN topology.
When you open the Hubs and Customer Edge Router folders, you can see the names of each CE functioning as a hub, as well as the list of CES that are members of the selected VPN (see Figure 4-25).
Step 2 Choose Sort > Ascending to sort the list in ascending order; or choose Sort > Descending to sort the list in descending order
You can view the Hubs or CEs in their new order.
You can view and retrieve various details concerning the CEs in the selected VPN.
The Node menu presents the following options:
Step 2 Choose the options you need from the Node menu.
The Management VPN technique is the default method provisioned by VPNSC: MPLS Solution. A key concept for this implementation technique is that all the CEs in the network are a member of the management VPN. The Management VPN is a VPN that belongs to the service provider so that the service provider can manage the VPNs that belong to the provider's customers. Figure 4-28 shows a typical topology for the Management VPN technique.
A Management VPN employs two devices called the Management CE (MCE) and the Management PE (MPE).
Device | Connectivity | Function |
|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
The MPE-MCE link uses a Management VPN (see the "Management VPN Technique" section) to connect to managed CEs. To connect to the PEs and NetFlow Connector, the MPE-MCE link uses a parallel IPv4 link.
The first step is to create a VPN Customer specifically reserved as the Management VPN Customer. The Management VPN Customer should have a single site with a single CE—the router designated as the Management CE—assigned to the Management VPN Customer's site.
To define a management VPN in VPNSC: MPLS Solution software, follow these steps:
You can also right-click the VPN Customers folder and choose New VPN Customer.
The New VPN Customer dialog box appears (see Figure 4-29).
Step 2 Enter the name of the Management VPN Customer. Remember that the Customer in this case is the service provider.
Step 3 Optionally, enter the contact information for the service provider network administrator.
Though it is not required, entering the contact information is recommended.
Step 4 To define the site for the Management VPN, click Add.
The Add Customer Site dialog box appears (see Figure 4-30).
Step 5 Enter the management site's name and location information.
Step 6 To add the Management CE to the management site, click Add.
The Add Customer Edge Routers dialog box appears (see Figure 4-31).
Step 7 From the Add Customer Edge Routers dialog box, select the name of the service provider network from the Network drop-down list.
Step 8 From the list of routers, select the router that is to function as a Management CE (MCE).
Step 9 Define the router as an MCE by choosing one of these two options, then click OK.
When you click OK, the selected router is designated as the MCE.
The next step is to provision a service request between the MCE and a PE designated as the Management PE (MPE). For detailed information on deploying service requests in the VPNSC: MPLS Solution software, see "Defining and Deploying MPLS VPN Service Requests."
The introductory panel in the Add VPN Service to CE wizard appears.
Step 2 Click Next. The dialog box shown in Figure 4-32 appears.
Step 3 From the Customer drop-down list, select the name of the Management customer.
Step 4 From the Site drop-down list, select the name of the Management site.
As shown in Figure 4-32, the name of the router designated as the MCE appears in the CE Routers pane.
Step 5 When completed with the selections, click Next.
Step 6 From the Provider drop-down list, select the name of the service provider.
Step 7 From the Region drop-down list, select the name of the Region where the MPE resides.
The list of routers in the selected Region appears in the PE Routers pane (see Figure 4-33).
Step 8 When completed with the selections, click Next.
The next dialog box (shown in Figure 4-34) asks you to specify the routing protocol used over the MPE-MCE link.
Step 9 Choose the routing protocol used for the link between the MPE and MCE.
Cisco recommends that you use a dynamic routing protocol for a Management VPN (that is, BGP or RIP).
For details about the routing protocols options available from this dialog box, see the "Choosing the Routing Protocol for the Link" section.
Step 10 Complete the information required for the selected routing protocol, then click Next.
The next dialog box (shown in Figure 4-35) asks you to specify the protocols redistributed from the MCE.
Step 11 If protocols are to be redistributed over the MPE-MCE link, complete the necessary information, then click Next.
For details, see the "Specifying Redistributed Protocols on the Link" section. The next dialog box asks you to select the type of interface (WAN or LAN) and the encapsulation used on the MPE and MCE.
Step 12 Specify the interface information for the MPE-MCE link, then click Next.
a. Specify whether the MPE-MCE link is on a WAN or LAN.
b. From the PE interface panel Interface drop-down list, select the interface for the MPE.
c. From the PE interface panel Encapsulation drop-down list, select the encapsulation type for the MPE.
d. From the CE interface panel Interface drop-down list, select the interface for the MCE.
e. From the CE interface panel Encapsulation drop-down list, select the encapsulation type for the MCE.
The next dialog box in the Add VPN Service to the CE wizard (see Figure 4-36) provides a way to define the IP addressing scheme that is appropriate for this MPE-MCE link.
Step 13 Choose the appropriate IP addressing scheme for the MPE and MCE.
Only the IP Numbered and IP Numbered with Extra CE Loopback options are valid for the MPE-MCE link.
For details on the options available on the IP Address Scheme dialog box, see the "Choosing an IP Addressing Scheme" section.
Step 14 Enter the IP addresses for the MPE-MCE link, then click Next.
a. In the PE Interfaces fields, enter the IP address for the MPE.
b. In the CE Interfaces fields, enter the IP address for the MCE
c. If you selected the IP Numbered with Extra CE Loopback option, In the CE Loopback fields, enter the IP address for the MCE loopback address.
Step 15 In the next dialog box, you can optionally specify the import map and maximum routes parameters for the MCE, then click Next.You can also enable NetFlow accounting on the MCE from this dialog box.
For details on these options, see the "Specifying VRF Parameters" section.
The next dialog box asks you to select a Class of Service (CoS) profile.
Step 16 If desired, select a CoS profile to assign to the PE-CE link, then click Next.
The next screen displays a summary of all the service settings defined for the Management VPN.
Step 17 Verify that the service request information is correct, then click Next.
The service request is assigned an ID number and submitted. This service request is now in the Requested state. For details on the states a service request moves through, see the "Service Request Summary" section.
|
Note To create the Management VPN, the service request must be deployed successfully. |
Step 18 From the VPN Console, choose Provisioning > Deploy Service Requests.
The Deploy Service Requests wizard begins. For details on completing the information for completing the Deployment wizard, see the "Deploying a VPN Service" section.
grey_mgmt_vpn_service_provider_name
Step 2 In the CERC Memberships dialog box, be sure to check the Join the management VPN option, as shown in Figure 4-37.
When you make the CE join the Management VPN in this step, VPNSC: MPLS Solution generates the appropriate route-map statements in the PE's configlet.
The function of the management route map is to allow only the routes to the specific CE into the management VPN. The Cisco IOS supports only one export route map and one import route map per VRF (and therefore, per VPN).
Step 3 Complete the service request wizard as described in the "Adding a Service for a PE-CE Link" section."
Posted: Wed Sep 20 14:57:47 PDT 2000
Copyright 1989-2000©Cisco Systems Inc.