MPLS VPN Configuration for Desklib Online Library Network

This article explains the configuration of Desklib online library network using MPLS VPN for better quality performance, network security, and bandwidth allocation. It covers the network topology, addressing, interface configuration, OSPF configuration, basic MPLS VPN configuration, and BGP configuration. The article also justifies the use of MPLS VPN for cloud-based applications.

Network Decisions
We designed the above model using MPLS VPN. Here we used three PE router. These PE router
may have one or more CE. All PE router use BGP configuration to dynamically communicate with each
other. Every CE router is directly attached to PE Routers. We have chosen the layer 3 MPLS VPN model
which creates more scalable and easy to manage the VPN. HR and Payroll routers are interconnected
between them. It acts as network loop routers or backbone connection to Sydney (PE) Router. Perth has
one CE Router (Marketing). Brisbane (PE) Router has two CE Routers (R & D, Manufacture). Sydney (PE)
router has HR and Payroll
Justifications
Why we choose MPLS VPN?
 It provides the best quality performance for cloud based application in chiefly. It controls the
traffic of the massive file transfer in cloud application also
 It is carried over single carrier’s network. It secures the network more than the public network
 It provides the bandwidth depends upon the customer requirement
PE1 (Perth) PE3 (Sydney)
PE2 (Brisbane)
Cloud (P)
CE1 (Marketing)
CE2 (R&D) CE3 (Manufacture) CE4 (HR) CE5 (Payroll)

Network Topology

Network Addressing
Network
Name
Number
of IP
Required
Network
Address
Subnet Mask IP Range Broadcast
Address
Marketing 250 200.200.200.0 255.255.255.0 200.200.200.1 to
200.200.200.254
200.200.200.255
Manufacture 200 200.200.201.0 255.255.255.0 200.200.201.1 to
200.200.201.254
200.200.201.255
R&D 50 200.200.202.0 255.255.255.192 200.200.202.1 to
200.200.202.62
200.200.202.63
HR 30 200.200.202.64 255.255.255.224 200.200.202.65 to
200.200.202.94
200.200.202.95
Payroll 25 200.200.202.96 255.255.255.224 200.200.202.97 to
200.200.202.126
200.200.202.127
Perth-
Marketing
2 200.200.202.128 255.255.255.252 200.200.202.129
to
200.200.202.130
200.200.202.131
RD – Brisbane 2 200.200.202.132 255.255.255.252 200.200.202.133
to
200.200.202.134
200.200.202.135
Manufacture-
Brisbane
2 200.200.202.136 255.255.255.252 200.200.202.137
to
200.200.202.138
200.200.202.139
Sydney-
Payroll
2 200.200.202.140 255.255.255.252 200.200.202.141
to
200.200.202.142
200.200.202.143
Sydney-HR 2 200.200.202.144 255.255.255.252 200.200.202.145
to
200.200.202.146
200.200.202.147
HR-Payroll 2 200.200.202.148 255.255.255.252 200.200.202.149
to
200.200.202.150
200.200.202.151

Interface Addressing
Network Name Interface IP Address Subnet Mask Default Gateway
Marketing Fa0/0 200.200.200.1 255.255.255.0 -
Marketing Fa0/1 200.200.202.130 255.255.255.252 -
Manufacture Fa0/1 200.200.201.1 255.255.255.0 -
Manufacture Fa0/0 200.200.202.137 255.255.255.252 -
R&D Fa0/1 200.200.202.1 255.255.255.192 -
R&D Fa0/0 200.200.202.134 255.255.255.252 -
HR Fa0/1 200.200.202.65 255.255.255.224 -
HR Fa1/0 200.200.202.150 255.255.255.252 -
HR Fa0/0 200.200.202.146 255.255.255.252 -
Payroll Fa0/1 200.200.202.97 255.255.255.224 -
Payroll Fa0/0 200.200.202.142 255.255.255.252 -
Payroll Fa1/0 200.200.202.149 255.255.255.252 -
Perth Fa0/1 200.200.202.129 255.255.255.252 -
Brisbane Fa0/1 200.200.202.138 255.255.255.252 -
Brisbane Fa1/0 200.200.202.133 255.255.255.252 -
Sydney Fa0/1 200.200.202.141 255.255.255.252 -
Sydney Fa1/0 200.200.202.145 255.255.255.252 -
Perth Fa0/0 150.50.50.50 255.255.255.252 -
Brisbane Fa0/0 150.50.50.21 255.255.255.252 -
Sydney Fa0/0 150.50.50.2 255.255.255.252 -

Basic Configuration
The Company has stipulated that all routers must be locally secure
The following command is used to enter into configuration mode
Perth#conf t
Enter configuration commands, one per line. End with CNTL/Z.
After entering configuration mode, set the console password. Here we use cisco as the password
Perth(config)#line console 0
Perth(config-line)# password cisco
Here login command is used to ask the password when we enter the console mode
Perth(config-line)#login
Here exit command is used to exit from the previous prompt
Perth(config-line)#exit
Set the telnet password as class
Perth(config)#line vty 0 4
Perth(config-line)#password class
Perth(config-line)#login
Perth(config-line)#exit
Here secret password is not able to view in the running configuration result
Perth(config)#enable secret cisco
Interface Configuration

After entering the configuration mode, select the interface and set the specified ip address to
that interface. No shut command is used to open the interface and configure that IP address to that
interface. Similarly, we configured all the interface which is specified in the networking address table
Perth(config)#interface FastEthernet0/0
Perth(config-if)# ip address 150.50.50.50 255.255.255.252
Perth(config-if)# no shut
Perth(config-if)#exit
DHCP Configuration
We have designed the DHCP server configuration to all CE router.
The below command is used to create the DHCP pool
Marketing(config)#ip dhcp pool marketdhcp
Setting the network address which is allocate to DHCP client
Marketing(dhcp-config)# network 200.200.200.0 255.255.255.0
Setting the default router IP address. But this address is the current router interface address
Marketing(dhcp-config)#default-router 200.200.200.1
Exit from the DHCP pool configuration
Marketing(dhcp-config)#exit
Remove the unnecessary IP from DHCP pool using the below command
Marketing(config)#ip dhcp excluded-address 200.200.200.1

OSPF Configuration
In Perth Router (PE), We create the OSPF AS 100 and enter into OSPF configuration mode
Perth(config)# router ospf 100
Configure the PE and P network
Perth(config-router)# network 150.50.50.48 0.0.0.3 area 0
Setting the Router ID as 1.1.1.1. It is used to debug the routing configuration if not configure in
the neighboring router
Perth(config-router)# router-id 1.1.1.1
Exit from the OSPF configuration mode
Perth(config-router)# exit
In Sydney Router (PE), We create the OSPF AS 100 and enter into OSPF configuration mode
Sydney(config)# router ospf 100
Configure the PE and P network
Sydney(config-router)# network 150.50.50.0 0.0.0.3 area 0
Setting the Router ID as 1.1.1.1. It is used to debug the routing configuration if not configure in
the neighboring router
Sydney(config-router)# router-id 2.2.2.2
Exit from the OSPF configuration mode
Sydney(config-router)# exit
In Brisbane Router (PE), we create the OSPF AS 100 and enter into OSPF configuration mode
Brisbane(config)# router ospf 100
Configure the PE and P network
Brisbane(config-router)# network 150.50.50.20 0.0.0.3 area 0
Setting the Router ID as 1.1.1.1. It is used to debug the routing configuration if not configure in
the neighboring router
Brisbane(config-router)# router-id 3.3.3.3
Exit from the OSPF configuration mode
Brisbane(config-router)# exit

In Cloud Router (P), we create the OSPF AS 100 and enter into OSPF configuration mode
Cloud(config)# router ospf 100
Configure the PE and P network
Cloud(config-router)# network 150.50.50.20 0.0.0.3 area 0
Cloud(config-router)# network 150.50.50.0 0.0.0.3 area 0
Cloud(config-router)# network 150.50.50.48 0.0.0.3 area 0
Setting the Router ID as 1.1.1.1. It is used to debug the routing configuration if not configure in
the neighboring router
Cloud(config-router)# router-id 4.4.4.4
Exit from the OSPF configuration mode
Cloud (config-router)# exit
Basic MPLS VPN Configuration
In Perth (PE) Router, we configure the vrf routing
Perth(config)# ip vrf markc1
Set the routing distinguisher as 65000:10 (here 65000 is the BGP AS)
Perth(config-vrf)# rd 65000:10
Set the Target VPN Extended Communities (here 65000 is the BGP AS)
Perth(config-vrf)# route-target both 65000:10
Exit from the VRF configuration
Perth(config-vrf)# exit
Assign the Marketing (CE) interface to the respective VRF
Perth(config)# interface fa0/1
Set the VRF routing label to Fast Ethernet interface
Perth(config-if)# ip vrf forwarding markc1
If any assigned IP removed automatically, we need to set once again
Perth(config-if)#
*Apr 19 20:47:43.275: %TDP-5-INFO: Default-IP-Routing-Table: TDP ID removed

Perth(config-if)# ip address 200.200.202.129 255.255.255.252
Perth(config-if)# no shut
Exit from the interface configuration
Perth(config-if)# exit
Configure the interface which is used in LDP
Perth(config)# interface fa0/0
Configure the MPLS parameter
Perth(config-if)# mpls ip
Perth(config-if)# no shut
Exit from the interface configuration
Perth(config-if)# exit
In Perth Router, Configure BGP with the Customer markc1
Perth(config)# router bgp 65000
Enter into the address family command mode
Perth(config-router)# address-family ipv4 vrf markc1
Specify the BGP neighbor (Marking Router BGP AS Number)
Perth(config-router-af)# neighbor 200.200.202.130 remote-as 65500
Set neighbor soft reconfigure
Perth(config-router-af)# neighbor 200.200.202.130 soft-reconfiguration inbound
Configure the override the AS number while sending update
Perth(config-router-af)# neighbor 200.200.202.130 as-override
Exit from address family mode
Perth(config-router-af)# exit
Configure the remote BGP router loopback
Perth(config-router)#neighbor 150.50.50.21 remote-as 65000
Perth(config-router)#neighbor 150.50.50.2 remote-as 65000
Configure the VPN of address family in BGP and activate the remote BGP router and define the
send community extended for the RT values to be sent and received

Perth(config-router)#address-family vpnv4
Perth(config-router-af)#neighbor 150.50.50.21 activate
Configure RT value used the extended community
Perth(config-router-af)#neighbor 150.50.50.21 send-community extended
Perth(config-router-af)#neighbor 150.50.50.2 activate
Perth(config-router-af)#neighbor 150.50.50.21 send-community extended
*Apr 20 04:13:16.979: %BGP-5-ADJCHANGE: neighbor 150.50.50.21 Up
Perth(config-router-af)#neighbor 150.50.50.2 send-community extended
Set no auto-summary configuration to BGP routing
Perth(config-router)# no auto-summary
Perth(config-router)# no synchronization
Perth(config-router)# Exit
In Marking Router (CE), we configure the BGP
Marketing(config)#router bgp 65500
Specify the BGP neighbor (Perth Router BGP AS Number)
Marketing(config-router)#neighbor 200.200.202.129 remote-as 65000
Set neighbor soft reconfigure
Marketing(config-router)#neighbor 200.200.202.129 soft-reconfiguration in
Set no auto-summary configuration to BGP routing
Marketing(config-router)#no auto-summary
Marketing(config-router)#no synchronization
Marketing(config-router)#exit
In Brisbane Router(PE), we configure the MPLS VPN
To enter into configuration mode
Brisbane#conf t
Enter configuration commands, one per line. End with CNTL/Z.
In Brisbane (PE) Router, we configure the vrf routing for R & D Customer

Brisbane(config)# ip vrf rdc1
Set the routing distinguisher as 65000:10 (here 65000 is the BGP AS)
Brisbane(config-vrf)# rd 65000:10
Set the Target VPN Extended Communities (here 65000 is the BGP AS)
Brisbane(config-vrf)# route-target both 65000:10
Brisbane(config-vrf)# exit
In Brisbane (PE) Router, we configure the vrf routing for Manufacture Customer
Brisbane(config)#ip vrf manuc1
Brisbane(config-vrf)#rd 65000:20
Brisbane(config-vrf)#route-target 65000:20
Brisbane(config-vrf)#exit

Assign the R&D (CE) interface to the respective VRF
Brisbane(config)#int fa1/0
Brisbane(config-if)#ip vrf forwarding rdc1
If any assigned IP removed automatically, we need to set once again
% Interface FastEthernet1/0 IP address 200.200.202.13 removed due to enabling VRF
rdc1
Brisbane(config-if)#ip address 200.200.202.133 255.255.255.252
Brisbane(config-if)#no shut
Brisbane(config-if)#exit
Assign the Manufactue (CE) interface to the respective VRF
Brisbane(config)#int fa0/1
Brisbane(config-if)#ip vrf forwarding manuc1
% Interface FastEthernet0/1 IP address 200.200.202.138 removed due to enabling VRF
manuc1
Brisbane(config-if)#
*Apr 20 03:40:38.295: %TDP-5-INFO: Default-IP-Routing-Table: TDP ID removed
Brisbane(config-if)#ip address 200.200.202.138 255.255.255.252
Brisbane(config-if)#no shut
Brisbane(config-if)#exit
Configure the interface which is used in LDP
Brisbane(config)#int fa0/0
Configure the MPLS parameter
Brisbane(config-if)#mpls ip
Brisbane(config-if)#exit
In Brisbane(Router, Configure BGP with the Customer rdc1(R&D) and Specify the BGP neighbor
Brisbane(config)#router bgp 65000
Brisbane(config-router)#address-family ipv4 vrf rdc1
Brisbane(config-router-af)#neighbor 200.200.202.134 remote-as 65500
Brisbane(config-router-af)#neighbor 200.200.202.134 soft-reconfiguration in

Brisbane(config-router-af)#neighbor 200.200.202.134 as-override
Brisbane(config-router-af)#exit
Enter into the address family command mode and Set neighbor soft reconfigure and override
the AS number while sending update
Brisbane(config-router)#address-family ipv4 vrf manuc1
Brisbane(config-router-af)#neighbor 200.200.202.137 remote-as 65500
Brisbane(config-router-af)#neighbor 200.200.202.137 soft-reconfiguration in
Brisbane(config-router-af)#neighbor 200.200.202.137 as-override
Brisbane(config-router-af)#exit
Advertise the loopback IP of local connection in BGP Routing
Brisbane(config-router)#neighbor 150.50.50.100 remote-as 65000
Brisbane(config-router)#neighbor 150.50.50.102 remote-as 65000
Set no auto-summary configuration to BGP routing
Brisbane(config-router)#no auto-summary
Brisbane(config-router)#no synchronization
Brisbane(config-router)#exit
Configure the VPN of address family in BGP and activate the remote BGP router and define the
send community extended for the RT values to be sent and received
Brisbane(config-router)#address-family vpnv4
Brisbane(config-router-af)#neighbor 150.50.50.100 activate
Brisbane(config-router-af)#neighbor 150.50.50.102 activate
Brisbane(config-router-af)#neighbor 150.50.50.100 send-community extended
Brisbane(config-router-af)#neighbor 150.50.50.102 send-community extended
Brisbane(config-router-af)#exit
Configure BGP Routing using AS 65500 and advertise the local IP address
RD(config)#router bgp 65500
RD(config-router)#neighbor 200.200.202.133 remote-as 65000
RD(config-router)#neighbor 200.200.202.133 soft-reconfiguration in
RD(config-router)#no auto-summary

RD(config-router)#no synchronization
RD(config-router)#exit
In Manufacture Router (CE) Configure BGP Routing using AS 65500 and advertise the local IP
address
Manufacture(config)#router bgp 65500
Manufacture(config-router)#neighbor 200.200.202.138 remote-as 65000
Manufacture(config-router)#neighbor 200.200.202.138 soft-reconfiguration in
Manufacture(config-router)#no auto-summary
Manufacture(config-router)#no synchronization
Manufacture(config-router)#exit
In Sydney (PE) Router, configure the loop back IP address
Sydney(config)#interface loopback 0
Sydney(config-if)#ip address 150.50.50.102 255.255.255.255
Sydney(config-if)#no shut
Sydney(config-if)#exit
Set the MPLS protocol as LDP
Sydney(config)#mpls label protocol ldp
Map the ldp with loopback address
Sydney(config)#mpls ldp router-id loopback 0
In Sydney (Router, Configure BGP with the Customer rdc1(R&D) and Specify the BGP neighbor
Sydney(config)#router bgp 65000
Sydney(config-router)#address-family ipv4 vrf sydhr
Sydney(config-router-af)#neighbor 200.200.202.146 remote-as 65500
Sydney(config-router-af)#neighbor 200.200.202.146 soft-reconfiguration in
Sydney(config-router-af)#neighbor 200.200.202.146 as-override
Sydney(config-router-af)#exit
Sydney(config-router)#address-family ipv4 vrf sydpay
Sydney(config-router-af)#neighbor 200.200.202.142 remote-as 65500

Sydney(config-router-af)#neighbor 200.200.202.142 soft-reconfiguration in
Sydney(config-router-af)#neighbor 200.200.202.142 as-override
Sydney(config-router-af)#exit
Advertise the loopback IP of local connection in BGP Routing
Sydney(config-router)#neighbor 150.50.50.100 remote-as 65000
Sydney(config-router)#no auto-summary
Sydney(config-router)#no synchronization
Sydney(config-router)#neighbor 150.50.50.100 update-source loopback 0
Sydney(config-router)#neighbor 150.50.50.100 next-hop-self
Sydney(config-router)#neighbor 150.50.50.101 remote-as 65000
Sydney(config-router)#neighbor 150.50.50.101 update-source loopback 0
Sydney(config-router)#neighbor 150.50.50.101 next-hop-self
Configure the VPN of address family in BGP and activate the remote BGP router and define the
send community extended for the RT values to be sent and received
Sydney(config-router)#address-family vpnv4
Sydney(config-router-af)#neighbor 150.50.50.100 activate
Sydney(config-router-af)#neighbor 150.50.50.100 send-community extended
Sydney(config-router-af)#neighbor 150.50.50.101 activate
Sydney(config-router-af)#neighbor 150.50.50.101 send-community extended
Sydney(config-router-af)#exit
Configure BGP Routing using AS 65500 and advertise the local IP address
HR(config)#router bgp 65500
HR(config-router)#neighbor 200.200.202.145 remote-as 65000
HR(config-router)#neighbor 200.200.202.145 soft-reconfiguration in
HR(config-router)#
*Apr 20 05:26:18.939: %BGP-5-ADJCHANGE: neighbor 200.200.202.145 Up
HR(config-router)#neighbor 200.200.202.149 remote-as 65500
HR(config-router)#neighbor 200.200.202.149 soft-reconfiguration in

HR(config-router)#no auto-summary
HR(config-router)#no synchronization
HR(config-router)#redistribute connected
HR(config-router)#exit
In Payroll (Router, Configure BGP the local system and Specify the BGP neighbor
Payroll(config)#router bgp 65500
Payroll(config-router)#neighbor 200.200.202.141 remote-as 65000
Payroll(config-router)#neighbor 200.200.202.141 soft-reconfiguration in
Payroll(config-router)#neighbor 200.200.202.150 remote-as 65500
Payroll(config-router)#neighbor 200.200.202.150 soft-reconfiguration in
Payroll(config-router)#no auto-summary
Payroll(config-router)#no synchronization
Payroll(config-router)#redistribute connected
Payroll(config-router)#exit
Payroll(config)#exit
In Sydney (PE) Router, we configure the vrf routing for Paybill and HRCustomer
Sydney(config)# ip vrf sydpay
Sydney(config-vrf)# rd 65000:10
Sydney(config-vrf)# route-target both 65000:10
Sydney(config-vrf)# exit
Sydney(config)# ip vrf sydhr
Sydney(config-vrf)# rd 65000:20
Sydney(config-vrf)# route-target both 65000:20
Sydney(config-vrf)# exit
Configure VRF interface and set the Sydney Paybill
Sydney(config)#interface fa0/1
Sydney(config-if)#ip vrf forwarding sydpay
Sydney(config-if)#ip address 200.200.202.141 255.255.255.252
Sydney(config-if)#no shut

Sydney(config-if)#ip vrf forwarding sydhr
Sydney(config-if)#ip address 200.200.202.145 255.255.255.252
Sydney(config-if)#exit
Brisbane Manufacture and Perth Marketing must not have any access to Sydney Payroll
Using ACL Extend configuration restrict to access Sydney Payroll Router
Payroll(config)#access-list 110 deny ip 200.200.201.0 0.0.0.255 200.200.202.96 0.0.0.31
Payroll(config)#access-list 110 deny ip 200.200.200.0 0.0.0.255 200.200.202.96 0.0.0.31
Payroll(config)#interface fastEthernet 0/0
Payroll(config-if)#ip access-group 110 in
Payroll(config-if)#exit

Testing
Show MPLS Interface (PE Router)
Using show mpls interfaces command
v
Show BGP Summary command in CE Router

Show MPLS Forwarding Table
Using show mpls forwarding-table command
Show IP routing table
Using show ip route command
Conclusion
In client router, we have set the static routing and DHCP server configuration. In PE Router, we
have implemented the OSPF 100 with area of 0. We have checked the routing table and testing the
connection using Ping command