Академический Документы
Профессиональный Документы
Культура Документы
Troubleshooting MPLS TE
Tunnels
IOS & IOS-XE
DGTL-TSCENT-409
#CiscoLive
Agenda
• MPLS TE Introduction & Overview
• Case Study 1: Path Calculation
• Case Study 2: L3VPN Traffic Blackholing
• Case Study 3: L2VPN Traffic Blackholing +
Auto-Tunnels
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 3
MPLS TE Introduction
& Overview
MPLS TE Intro
• MPLS TE allows us to influence the path of traffic through an MPLS
environment using parameters other than solely the IGP metric
within the core
Ø For instance: explicit paths, bandwidth requirements, affinity / path color
• MPLS TE tunnels create unidirectional LSPs from head-end to tail-
end
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 5
TE Tunnel Establishment
• Prerequisites:
Ø mpls traffic-eng tunnels configured globally and on core
interfaces
Ø ip rsvp bandwidth configured on core interfaces
Ø mpls traffic-eng router-id <Loopback> configured under IGP
process (OSPF or IS-IS)
Ø mpls traffic-eng [level-1|level-2] under IS-IS process, or
mpls traffic-eng area <area-id> under OSPF process
• In order to bring up an MPLS TE tunnel, the Path Calculation and
LSP Signaling must be successful
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 6
Path Calculation
• Performed by the head-end router
• CSPF (Constrained Shortest Path First) is the algorithm by which TE
tunnel paths are calculated
Ø Ituses tunnel constraint info in conjunction with MPLS TE topology info
that has been advertised within the link-state IGP (OSPF or IS-IS)
• Links which do not meet the tunnel constraints are ignored
• If path calculation is successful, it is followed by LSP signaling
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 7
LSP Signaling
• RSVP is responsible for signaling labels for TE tunnels
• The PATH message is initiated at the head-end toward its next hop
on the path
• Each intermediate router sends a PATH message toward its next
hop until the tail-end is reached
• Finally, starting with the tail-end, the reservation (RESV) message is
sent by each router to the previous hop on the path going back to
the head-end to allocate labels
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 8
Case Study Topology
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 9
Case Study 1:
Path Calculation
TE Tunnel Down
• When a TE tunnel will not come up, we must determine whether it
is the path calculation or LSP signaling that is failing
• In this case study, we will look at a situation in which a particular TE
tunnel is failing to come up due to a path calculation problem
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 11
Example Scenario
interface Tunnel1435
ip unnumbered Loopback0
mpls traffic-eng tunnels
tunnel mode mpls traffic-eng
tunnel destination 5.5.5.5
tunnel mpls traffic-eng autoroute announce
tunnel mpls traffic-eng priority 7 7
tunnel mpls traffic-eng bandwidth 300000
tunnel mpls traffic-eng path-option 1 explicit name R1->R4->R3->R5
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 12
Checking Path Calculation
Config Parameters:
Bandwidth: 300000 kbps (Global) Priority: 7 7 Affinity: 0x0/0xFFFF
Metric Type: TE (default)
<SNIP>
Prior LSP: [ID: 2608]
ID: path option 1 [2670]
Removal Trigger: path error
Last Error: CTRL:: Can't use link 10.3.5.3 on node 3.3.3.3
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 13
Checking Path Calculation (cont.)
Debug mpls traffic-eng path lookup + debug mpls traffic-eng path spf:
*May 19 19:36:53.010: TE-PCALC-VERIFY: Verify:
TE-PCALC-VERIFY: 0001.3333.3333.00, 10.3.5.3 points to
TE-PCALC-VERIFY: 0001.5555.5555.00, 10.3.5.5
*May 19 19:36:53.011: Link 10.3.5.3 forward bw avail=250000, bw req=300000, current bw generation=157, link bw generation=0 path bw=300000 bw_delta=300000
*May 19 19:36:53.011: TE-PCALC-SPF: REJECT(forward bw available too small) ip_address 10.3.5.3 bw 250000 req 300000
<SNIP>
*May 19 19:36:53.014: TE-PCALC-VERIFY: 1.1.1.1_2677->5.5.5.5_1435 {7}: Verify Failed: Can't use link 10.3.5.3 on node 3.3.3.3
<SNIP>
*May 19 19:36:53.017: TE-PCALC-API: 1.1.1.1_2677->5.5.5.5_1435 {7}: P2P LSP Path Lookup result: failed
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 14
Checking the TE Topology
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 15
Possible Resolutions
• Define a different path for the tunnel, or try a dynamic path option
Ø Ifpath calculation still fails with a dynamic path option, then it would
indicate we do not have any available path that can satisfy the specified
constraints
• Reduce the required bandwidth for the tunnel
• Lower the setup and hold priority values for the tunnel (Note: this
would cause at least one other tunnel to go down if we make no
changes to the required bandwidth)
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 16
Summary
• It is important to understand the TE topology, especially when using
explicit path options, as we must avoid situations in which the path
cannot satisfy the constraints configured on the tunnel
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 17
Case Study 2:
L3VPN Traffic Blackholing
Non-End-to-End TE Tunnels
• When running TE tunnels that are not directly from ingress PE to
egress PE, it is possible to run into a traffic blackholing scenario
• In this case study we will look at this type of issue occurring on an
L3VPN MPLS TE circuit, and we will discuss what causes this to
happen and how to resolve it
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 19
Checking the LSP
R1-PE#show ip bgp vpnv4 vrf A 8.8.8.8
BGP routing table entry for 1:1:8.8.8.8/32, version 77
Paths: (1 available, best #1, table A)
<SNIP>
5.5.5.5 (via default) from 3.3.3.3 (3.3.3.3)
Origin IGP, metric 0, localpref 100, valid, internal, best
Extended Community: RT:100:100
Originator: 5.5.5.5, Cluster list: 3.3.3.3
mpls labels in/out nolabel/28
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 20
Checking the LSP (cont.)
P2P TUNNELS/LSPs:
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 21
Summary
Problem: Resolution:
• R4 pops the TE label because it is • In order for R6 to forward the
the penultimate hop for the tunnel packet to R5 after receiving it on
from R1 to R6 Tunnel 16, the packet must come
in with R6’s local label for
• Because R6 receives a packet with
forwarding to R5
an unrecognized VPNv4 label, it is
unable to forward it and the packet • To resolve this, we can form a
is dropped targeted LDP session over the
tunnel between R1 and R6,
allowing R6 to advertise an LDP
label to R1 for R5’s loopback
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 22
Resolution
R1-PE#conf t
R1-PE(config)#interface tunnel 16
R1-PE(config-if)#mpls ip
R6-PE#conf t
R6-PE(config)#mpls ldp neighbor 1.1.1.1 targeted
OR
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 23
Resolution (cont.)
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 24
Summary
• When the TE tunnel is not end-to-end (from ingress PE to egress
PE), we must make sure the tail-end router signals an LDP label
over the TE tunnel to the head-end in order to prevent an
incomplete LSP scenario
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 25
Case Study 3:
L2VPN Traffic Blackholing
+ Auto-Tunnels
TE Auto-Tunnels
• Auto-tunnels can be configured to dynamically create one-hop
primary TE tunnels along with backup tunnels for link protection
• However there is potential to run into a similar traffic blackholing
scenario to the one we saw previously
• In this case study we will look at this type of issue occurring on an
L2VPN MPLS TE circuit
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 27
Auto-Tunnel Base Config
• Primary Tunnels:
mpls traffic-eng auto-tunnel primary onehop
mpls traffic-eng auto-tunnel primary tunnel-num min <num> max <num>
mpls traffic-eng auto-tunnel primary config unnumbered-interface <Loopback>
• Backup Tunnels:
mpls traffic-eng auto-tunnel backup nhop-only
mpls traffic-eng auto-tunnel backup tunnel-num min <num> max <num>
mpls traffic-eng auto-tunnel primary config unnumbered-interface <Loopback>
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 28
Checking the LSP
R2-PE#show mpls l2transport vc 10
Local intf Local circuit Dest address VC ID Status
------------- -------------------------- --------------- ---------- ----------
VFI 10 vfi 6.6.6.6 10 DOWN
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 29
Checking the LSP (cont.)
R2-PE#sh mpls traffic-eng tunnels tunnel 1001
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 30
Summary
Problem: Resolution:
• Similar to what we saw • We need a way for R2 and R6
previously, there is an to learn labels for each other
incomplete LSP because the so they can forward through R4
TE tunnel in this case is one- using the one-hop tunnels
hop, not end-to-end
• This will involve signaling labels
• Here it is causing the VPLS over the one-hop tunnels to R4
pseudowire to not come up in so it is able to then advertise
the first place them between R2 and R6
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 31
Resolution
R4-P#conf t
R4-P(config)#mpls ldp discovery targeted-hello accept
R2-PE#conf t R6-PE#conf t
R2-PE(config)#mpls traffic-eng auto-tunnel primary config mpls ip R6-PE(config)#mpls traffic-eng auto-tunnel primary config mpls ip
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 32
Resolution (cont.)
R2-PE#sh mpls l2transport vc 10
Local intf Local circuit Dest address VC ID Status
R2 now has an LDP label that it ------------- -------------------------- --------------- ---------- ----------
VFI 10 vfi 6.6.6.6 10 UP
can use to reach R6 via the one-
R2-PE#sh mpls forwarding-table 6.6.6.6 detail
hop tunnel to R4 Local Outgoing Prefix Bytes Label Outgoing Next Hop
Label Label or Tunnel Id Switched interface
41 36 6.6.6.6/32 0 Tu1001 point2point
MAC/Encaps=14/18, MRU=1500, Label Stack{36}, via Gi5
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 33
Summary
• One-hop TE auto-tunnels are inherently not end-to-end in the
absence of a direct link from PE to PE, so in a situation like this we
must make sure they are configured to signal LDP labels in order to
prevent an incomplete LSP scenario
#CiscoLive DGTL-TSCENT-409 © 2020 Cisco and/or its affiliates. All rights reserved. Cisco Public 34
Thank you
#CiscoLive
#CiscoLive