NAT over MPLS VPN

Step 1: config MPLS VPN
 - network: 10.1.xy.0/24
 - loopback address: x.x.x.0/24
 - R2, R3, R4 core MPLS. running ospf are 0.
 - R2 and R4 establish M-BGP
Step 2: config nat on R4.
R4#
interface Loopback1
 ip vrf forwarding VPN
 ip address 44.44.44.44 255.255.255.0
 ip nat outside
 ip virtual-reassembly
!
interface FastEthernet0/0
 ip vrf forwarding VPN
 ip address 192.168.45.4 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface Serial0/0
 ip address 10.1.34.4 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 ip ospf 1 area 0
 mpls ip
!
ip route vrf VPN 5.5.5.5 255.255.255.255 FastEthernet0/0 192.168.45.5
!
ip nat inside source list 1 interface Loopback1 vrf VPN overload
!
access-list 1 permit 5.5.5.5
-------------------------------------------------------------------------------------------
R5# 
interface FastEthernet0/0
 ip address 192.168.45.5 255.255.255.0
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 10.1.45.4

Step 3: verify
R5#ping 1.1.1.1 so l0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 5.5.5.5
!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 32/46/84

R4#debug ip nat
Mar  1 00:38:42.427: NAT*: s=5.5.5.5->44.44.44.44, d=1.1.1.1 [70]
*Mar  1 00:38:42.507: NAT*: s=1.1.1.1, d=44.44.44.44->5.5.5.5 [70]
*Mar  1 00:38:42.535: NAT*: s=5.5.5.5->44.44.44.44, d=1.1.1.1 [71]
*Mar  1 00:38:42.559: NAT*: s=1.1.1.1, d=44.44.44.44->5.5.5.5 [71]
*Mar  1 00:38:42.575: NAT*: s=5.5.5.5->44.44.44.44, d=1.1.1.1 [72]
*Mar  1 00:38:42.583: NAT*: s=1.1.1.1, d=44.44.44.44->5.5.5.5 [72]
*Mar  1 00:38:42.603: NAT*: s=5.5.5.5->44.44.44.44, d=1.1.1.1 [73]
*Mar  1 00:38:42.631: NAT*: s=1.1.1.1, d=44.44.44.44->5.5.5.5 [73]
*Mar  1 00:38:42.655: NAT*: s=5.5.5.5->44.44.44.44, d=1.1.1.1 [74]
*Mar  1 00:38:42.667: NAT*: s=1.1.1.1, d=44.44.44.44->5.5.5.5 [74]
R4#show ip nat translations vrf VPN
Pro Inside global      Inside local       Outside local      Outside global
icmp 44.44.44.44:14    5.5.5.5:14         1.1.1.1:14         1.1.1.1:14

MPLS TE Attribute flag

Tunnel Affinity là một thuộc tính của Tunnel được dùng để xác định xem đường đi của Tunnel đó có thể đi qua 1 link nào đó không. Thông thường Tunnel sẽ được khai báo 2 thuộc tính là AFFINITY và MASK, còn link thì được khai báo thuộc tính FLAGS

Khai báo thuộc tính AFFINITY cho tunnel

Router(config)#interface tunnel 0.

Router(config-if)#tunnel mpls traffic-eng affinity AFFINITY MASK

Trong đó AFFINITY và MASK là những giá trị nhị phân 32 bit nhận giá trị 0x0 – 0xFFFFFFFF

Khai báo thuộc tính FLAGS cho interface (link)

Router(config-if)#mpls traffic-eng attribute flags attribute

Trong đó attribute là một giá trị nhị phân 32 bit nhận giá trị từ 0x0 – 0xFFFFFFFF

Nếu

AFFINITY & MASK = FLAGS & MASK thì tunnel có thể đi qua link

AFFINITY & MASK ≠ FLAGS & MASK thì tunnel không thể đi qua link

Nếu không cấu hình default mask = 0xFFFF

R1: interface Tunnel1  ip unnumbered Loopback0  mpls traffic-eng tunnels  tunnel destination 2.2.2.2  tunnel mode mpls traffic-eng  tunnel mpls traffic-eng autoroute announce  tunnel mpls traffic-eng priority 6 6  tunnel mpls traffic-eng bandwidth  100  tunnel mpls traffic-eng affinity 0x2 mask 0x3  tunnel mpls traffic-eng path-option 1 explicit name WAN1 lockdown ! ip explicit-path name WAN1 enable  next-address 10.1.12.2

R1 interface FastEthernet0/0  ip address 10.1.12.1 255.255.255.0  ip ospf 1 area 0  duplex auto  speed auto  mpls traffic-eng tunnels  mpls traffic-eng attribute-flags 0x2  ip rsvp bandwidth 500

AFFINITY & MASK  

Affinity	00000010
Mask	00000011
AND	00000010

FLAGS & MASK

Flag	00000010
Mask	00000011
AND	00000010

=> match vậy tunnel có thể đi qua link

MPLS TE priority

• 
  
1. Priority
Some tunnels are more inportance than others. For example, you might have tunnels carrying VoIP traffic and tunnels carrying data traffic that a competing for the sme resource. You might simple have spme data tunnels that are more importance than others.
Each tunnel has a priority, and more-importance tunnels take precedence over less-important tunnels. Less-important tunnels are pushed out of the way and are made to recalculate a path, and their resource are given to the more important tunnel




EX: tun0 and tun 1 cung di tren 1 duong R1-R2-R4


" show mpls traffic-eng topology "


Truong hop1: bandwidth tun0 = tun1 = 0

	Priority	Bandwith config	Total Allocated	Global Pool Reservable
Tun0 (priority 5 5)	5	0	0	50
	6	0	0	50
Tun1 (priority 7 7)	7	0	0	50



Truong hop2: bandwidth tun1=30, bandwith tun0 = 0

	Priority	Bandwith config	Total Allocated	Global Pool Reservable
Tun0 (priority 5 5)	5	0	0	50
	6	0	0	50
Tun1 (priority 7 7)	7	30	30	20





Truong hop3: bandwidth tun1=30 va bandwidth tun0 = 10
Vi tun 0 pri 5, nen no se preemt bandwith pri 6 and 7.
Truong hop 2: pri 7 co bandwidth con lai = 20, nhung pri 5 chiem 10 -> con lai 10
                           pri 6 co bandwidth con lai = 50 (chua dung), nhung pri5 chiem 10 -> con lai 40



	Priority	Bandwith config	Total Allocated	Global Pool Reservable
Tun0 (priority 5 5)	5	10	10	40
	6	0	0	40
Tun1 (priority 7 7)	7	30	30	10



Truong hop4: bandwidth tun 1=30 , bandwidth tun0 = 40.
    pri 7 bandwidth = 30 con lai bandwidth 20  nhung bi Pri5 bandwith = 40,
    -> pri7 k du bandwidth ->  duong tun1 down de giai phong bang thong cung cap tun0



	Priority	Bandwith config	Total Allocated	Global Pool Reservable
Tun0 (priority 5 5)	5	40	40	10
	6	0	0	10
Tun1 (priority 7 7)	7	30	0	10



Ketluan: 50k bandwith duoc su dung cho tat ca gia tri priority 0 -7
Priority thap la tot nhat, co kha nang chiem giu bang thong cua prority cao hon. Priority =0 khong bi chiem giu




2. Priority :  setup and holding priority



Bw[5]	40	10
Bw[6]	0	10
Bw[7]	0	10
Tunnel 0	40	priority	7       6
Tunnel 1	30	priority	7       5



Cho 2 tunnel:
Tunnel 1: priority  7 6
Tunnel 2: priority   6 5
Gia su tunnel 1 up truoc. Khi tunnel 2 up, no se so sanh gia tri setup priority cua no voi gia tri hold priority cua tunnle 1 neu nho hon thi tunnel 2 len va tunnel 1 down.