Downloads |
 Feedback
|
Table Of Contents
MPLS LDP Inbound Label Binding Filtering
Information about MPLS LDP Inbound Label Binding Filtering
How to Configure MPLS LDP Inbound Label Binding Filtering
Configuring MPLS LDP Inbound Label Binding Filtering
Verifying that MPLS LDP Inbound Label Bindings are Filtered
Configuration Examples for MPLS LDP Inbound Label Binding Filtering
mpls ldp neighbor labels accept
MPLS LDP Inbound Label Binding Filtering
Multiprotocol Label Switching (MPLS) Label Distribution Protocol (LDP) supports inbound label binding filtering. You can use the MPLS LDP feature to configure access control lists (ACLs) for controlling the label bindings a label switch router (LSR) accepts from its peer LSRs.
History for the MPLS LDP Inbound Label Binding Filtering Feature
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
Information about MPLS LDP Inbound Label Binding Filtering
•
•
Information about MPLS LDP Inbound Label Binding Filtering
The MPLS LDP Inbound Label Binding Filtering feature may be used to control the amount of memory used to store LDP label bindings advertised by other routers. For example, in a simple MPLS Virtual Private Network (VPN) environment, the VPN provider edge (PE) routers may require LSPs only to their peer PE routers (that is, they do not need LSPs to core routers). Inbound label binding filtering enables a PE router to accept labels only from other PE routers.
How to Configure MPLS LDP Inbound Label Binding Filtering
This section includes the following tasks:
•
•
Configuring MPLS LDP Inbound Label Binding Filtering
Perform this task to configure a router for inbound label filtering. The following configuration allows the router to accept only the label for prefix 25.0.0.2 from LDP neighbor router 10.12.12.12.
Restrictions
Inbound label binding filtering does not support extended ACLs; it only supports standard ACLs.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Verifying that MPLS LDP Inbound Label Bindings are Filtered
If inbound filtering is enabled, perform the following steps to verify that inbound label bindings are filtered:
Step 1
show mpls ldp neighbor [vrf vpn-name][address | interface] [detail]
Note
Following is sample output from the show mpls ldp neighbor command.
Router# show mpls ldp neighbor 10.12.12.12 detailPeer LDP Ident: 10.12.12.12:0; Local LDP Ident 10.13.13.13:0TCP connection: 10.12.12.12.646 - 10.13.13.13.12592State: Oper; Msgs sent/rcvd: 49/45; Downstream; Last TIB rev sent 1257Up time: 00:32:41; UID: 1015; Peer Id 0;LDP discovery sources:Serial1/0; Src IP addr: 25.0.0.2holdtime: 15000 ms, hello interval: 5000 msAddresses bound to peer LDP Ident:10.0.0.129 10.12.12.12 10.0.0.2Peer holdtime: 180000 ms; KA interval: 60000 ms; Peer state: estabLDP inbound filtering accept acl: 1Step 2
show ip access-list [access-list-number | access-list-name]
Note
The following command output shows the contents of IP access list 1:
Router# show ip access 1Standard IP access list 1permit 10.0.0.0, wildcard bits 0.0.0.255 (1 match)Step 3
Router# show mpls ldp bindingstib entry: 10.0.0.0/8, rev 4local binding: tag: imp-nulltib entry: 10.2.0.0/16, rev 1137local binding: tag: 16tib entry: 10.2.0.0/16, rev 1139local binding: tag: 17tib entry: 10.12.12.12/32, rev 1257local binding: tag: 18tib entry: 10.13.13.13/32, rev 14local binding: tag: imp-nulltib entry: 10.10.0.0/16, rev 711local binding: tag: imp-nulltib entry: 10.0.0.0/8, rev 1135local binding: tag: imp-nullremote binding: tsr: 12.12.12.12:0, tag: imp-nulltib entry: 10.0.0.0/8, rev 8local binding: tag: imp-nullRouter#
Configuration Examples for MPLS LDP Inbound Label Binding Filtering
In the following example, the mpls ldp neighbor labels accept command is configured with an access control list to filter label bindings received on sessions with the neighbor 10.110.0.10.
Label bindings for prefixes that match 10.b.c.d are accepted, where b is less than or equal to 63, and c and d can be any integer between 0 and 128. Other label bindings received from 10.110.0.10 are rejected.
Router# configure terminalRouter(config)# access-list 1 permit 10.63.0.0 0.63.255.255Router(config)# mpls ldp neighbor 10.110.0.10 labels accept 1Router(config)# endIn the following example, the show mpls ldp bindings neighbor command displays label bindings that were learned from 10.110.0.10. This example verifies that the LIB does not contain label bindings for prefixes that have been excluded.
Router# show mpls ldp bindings neighbor 10.110.0.10tib entry: 10.2.0.0/16, rev 4remote binding: tsr: 10.110.0.10:0, tag: imp-nulltib entry: 10.43.0.0/16, rev 6remote binding: tsr: 10.110.0.10:0, tag: 16tib entry: 10.52.0.0/16, rev 8remote binding: tsr: 10.110.0.10:0, tag: imp-nullAdditional References
The following sections provide additional references related to MPLS LDP inbound label binding filters.
Related Documents
Standards
MIBs
LDP Specification, draft-ietf-mpls-ldp-08.txt
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
RFCs
Technical Assistance
Command Reference
This section documents new and modified commands only.
New Commands
•
Modified Commands
clear mpls ldp neighbor
To forcibly reset a label distribution protocol (LDP) session, use the clear mpls ldp neighbor command in privileged EXEC mode.
clear mpls ldp neighbor [vrf vpn-name] {nbr-address | *}
Syntax Description
Defaults
No default behavior or values
Command Modes
Privileged EXEC
Command History
Usage Guidelines
The clear mpls ldp neighbor command terminates the specified LDP sessions. The LDP sessions should be reestablished if the LDP configuration remains unchanged.
You can clear an LDP session for an interface-specific label space of an LSR by issuing the no mpls ip command and then the mpls ip command on the interface associated with the LDP session.
Examples
The following example resets an LDP session:
Router# clear mpls ldp neighbor 10.12.12.12To verify the results of the clear mpls ldp neighbor command, enter the show mpls ldp neighbor command. Notice the value in the "Up time" field.
Router# show mpls ldp neighbor 10.12.12.12Peer LDP Ident: 10.12.12.12:0; Local LDP Ident 10.13.13.13:0TCP connection: 10.12.12.12.646 - 10.13.13.13.15093State: Oper; Msgs sent/rcvd: 142/138; DownstreamUp time: 02:16:28LDP discovery sources:Serial1/0, Src IP addr: 10.0.0.2Addresses bound to peer LDP Ident:10.0.0.129 10.12.12.12 10.0.0.2 10.1.0.510.7.0.1Then enter the following clear mpls ldp neighbor 12.12.12.12 command. With mpls ldp logging configured, the easiest way to verify the clear mpls ldp neighbor command is to monitor the LDP log messages.
Router# clear mpls ldp neighbor 10.12.12.121w1d: %LDP-5-CLEAR_NBRS: Clear LDP neighbors (10.12.12.12) by console1w1d: %LDP-5-NBRCHG: LDP Neighbor 10.12.12.12:0 is DOWN1w1d: %LDP-5-NBRCHG: LDP Neighbor 10.12.12.12:0 is UPReenter the show mpls ldp neighbor 10.12.12.12 command. Notice that the "Up time" value has been reset.
Router# show mpls ldp neighbor 10.12.12.12Peer LDP Ident: 10.12.12.12:0; Local LDP Ident 10.13.13.13:0TCP connection: 10.12.12.12.646 - 10.13.13.13.15095State: Oper; Msgs sent/rcvd: 125/121; DownstreamUp time: 00:00:05LDP discovery sources:Serial1/0, Src IP addr: 10.0.0.2Addresses bound to peer LDP Ident:10.0.0.129 10.12.12.12 10.0.0.2 10.1.0.510.7.0.1The following example resets all LDP sessions:
Router# clear mpls ldp neighbor *Related Commands
mpls ldp neighbor labels accept
To configure a label switching router (LSR) to filter label distribution protocol (LDP) inbound label bindings from a particular LDP peer, use the mpls ldp neighbor labels accept command in global configuration mode. To disable this feature, use the no form of this command.
mpls ldp neighbor [vrf vpn-name] nbr-address labels accept acl
no mpls ldp neighbor [vrf vpn-name] nbr-address labels accept acl
Syntax Description
Defaults
If the vrf keyword is not specified, the specified LDP neighbor is configured in the default routing domain.
Command Modes
Global configuration
Command History
Usage Guidelines
The specified ACL is used to filter label bindings advertised by the specified neighbor. If the prefix part of the label binding is permitted by the ACL, the router will accept the binding. If the prefix is denied, the router will not accept or store the binding.
This functionality is particularly useful when two different entities manage peer LSRs; that is, the recipient cannot perform filtering by altering the configuration of the sender. This is likely to occur in an MPLS virtual private network (VPN) that is using the LDP-based Carrier Supporting Carrier (CSC) feature. In that situation, the backbone carrier may want to restrict the set of label bindings that its provider edge (PE) router may learn from an adjacent customer edge (CE) router that a customer carrier operates.
When inbound label binding filtering is configured, certain configuration changes may require a router to retain bindings that it previously discarded. For example:
•
•
A router does not maintain a record of the set of bindings it previously discarded. Therefore, it cannot ask its neighbors to readvertise just those bindings. In addition, LDP (as defined by RFC 3036) does not provide a means for a router to signal its neighbors to readvertise all label bindings. Consequently, to relearn label bindings following such configuration changes, you must reset the LDP session or sessions by using the clear mpls ldp neighbor command.
Note
Examples
The following example specifies that the LSR accepts inbound label bindings from neighbor 19.19.19.19 in vrf vpn1 for prefixes permitted by the ACL named aclone:
Router(config)# mpls ldp neighbor vrf vpn1 19.19.19.19 label accept acloneRelated Commands
show mpls ldp neighbor
To display the status of label distribution protocol (LDP) sessions, use the show mpls ldp neighbor command in privileged EXEC mode.
show mpls ldp neighbor [vrf vpn-name] [address | interface] [detail]
show mpls ldp neighbor [all]
Syntax Description
Defaults
This command displays information about LDP neighbors for the default routing domain if the optional vrf keyword is not specified.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
The show mpls ldp neighbor command can provide information about all LDP neighbors, or the information can be limited to the following:
•
•
Note
Examples
The following shows sample output from the show mpls ldp neighbor command:
Router# show mpls ldp neighborPeer LDP Ident: 10.0.7.7:2; Local LDP Ident 10.1.1.1:1TCP connection: 10.0.7.7.11032 - 10.1.1.1.646State: Oper; Msgs sent/rcvd: 5855/6371; Downstream on demandUp time: 13:15:09LDP discovery sources:ATM3/0.1Peer LDP Ident: 10.1.1.1:0; Local LDP Ident 10.1.1.1:0TCP connection: 10.1.1.1.646 - 10.1.1.1.11006State: Oper; Msgs sent/rcvd: 4/411; DownstreamUp time: 00:00:52LDP discovery sources:Ethernet1/0/0Addresses bound to peer LDP Ident:10.0.0.29 10.1.1.1 10.0.0.199 10.10.1.110.205.0.9The following shows sample output from the show mpls ldp neighbor vrf vpn10 command, which displays the LDP neighbor information for the specified VPN routing/forwarding instance named vpn10:
Router# show mpls ldp neighbor vrf vpn10Peer LDP Ident:10.14.14.14:0; Local LDP Ident 10.29.0.2:0TCP connection:10.14.14.14.646 - 10.29.0.2.11384State:Oper; Msgs sent/rcvd:1423/800; DownstreamUp time:02:38:11LDP discovery sources:ATM3/0/0.10Addresses bound to peer LDP Ident:10.3.36.9 10.7.0.1 10.14.14.14 10.13.0.110.15.0.1 10.17.0.1 10.19.0.1 10.21.0.110.23.0.1 10.25.0.1 10.27.0.1 10.29.0.110.31.0.1 10.33.0.1 10.35.0.1 10.37.0.110.39.0.1 10.41.0.1 10.43.0.1 10.45.0.110.47.0.1 10.49.0.1 10.51.0.1 10.53.0.110.55.0.1 10.57.0.1 10.59.0.1 10.61.0.110.63.0.1 10.65.0.1 10.67.0.1 10.69.0.110.71.0.1 10.73.0.1 10.75.0.1 10.77.0.110.79.0.1 10.81.0.1 10.83.0.1 10.85.0.110.87.0.1 10.89.0.1 10.91.0.1 10.93.0.110.95.0.1 10.97.0.1 10.99.0.1 10.101.0.110.103.0.1 10.105.0.1 10.107.0.1 10.109.0.110.4.0.2 10.3.0.2Router#The following shows sample output from the show mpls ldp neighbor all command, which displays the LDP neighbor information for all VPN routing/forwarding instances, including those in the default routing domain. In this example, note that the same neighbor LDP ID (14.14.14.14) appears in all the listed VRF interfaces, highlighting the fact that the same IP address can coexist in different VPN routing/forwarding instances.
Router# show mpls ldp neighbor allPeer TDP Ident:101.11.11.11:0; Local TDP Ident 10.12.12.12:0TCP connection:10.11.11.11.711 - 10.12.12.12.11003State:Oper; PIEs sent/rcvd:185/187; DownstreamUp time:02:40:02TDP discovery sources:ATM1/1/0.1Addresses bound to peer TDP Ident:10.3.38.3 10.1.0.2 10.11.11.11VRF vpn1:Peer LDP Ident:10.14.14.14:0; Local LDP Ident 10.7.0.2:0TCP connection:10.14.14.14.646 - 10.7.0.2.11359State:Oper; Msgs sent/rcvd:952/801; DownstreamUp time:02:38:49LDP discovery sources:ATM3/0/0.1Addresses bound to peer LDP Ident:3.3.36.9 10.7.0.1 14.14.14.14 10.13.0.110.15.0.1 10.17.0.1 10.19.0.1 10.21.0.110.23.0.1 10.25.0.1 10.27.0.1 10.29.0.110.31.0.1 10.33.0.1 10.35.0.1 10.37.0.110.39.0.1 10.41.0.1 10.43.0.1 10.45.0.110.47.0.1 10.49.0.1 10.51.0.1 10.53.0.110.55.0.1 10.57.0.1 10.59.0.1 10.61.0.110.63.0.1 10.65.0.1 10.67.0.1 10.69.0.110.71.0.1 10.73.0.1 10.75.0.1 10.77.0.110.79.0.1 10.81.0.1 10.83.0.1 10.85.0.110.87.0.1 10.89.0.1 10.91.0.1 10.93.0.110.95.0.1 10.97.0.1 10.99.0.1 10.101.0.110.103.0.1 10.105.0.1 10.107.0.1 10.109.0.110.4.0.2 10.3.0.2VRF vpn2:Peer LDP Ident:10.14.14.14:0; Local LDP Ident 10.13.0.2:0TCP connection:10.14.14.14.646 - 10.13.0.2.11361State:Oper; Msgs sent/rcvd:964/803; DownstreamUp time:02:38:50LDP discovery sources:ATM3/0/0.2Addresses bound to peer LDP Ident:3.3.36.9 10.7.0.1 14.14.14.14 10.13.0.110.15.0.1 10.17.0.1 10.19.0.1 10.21.0.110.23.0.1 10.25.0.1 10.27.0.1 10.29.0.110.31.0.1 10.33.0.1 10.35.0.1 10.37.0.110.39.0.1 10.41.0.1 10.43.0.1 10.45.0.110.47.0.1 10.49.0.1 10.51.0.1 10.53.0.110.55.0.1 10.57.0.1 10.59.0.1 10.61.0.110.63.0.1 10.65.0.1 10.67.0.1 10.69.0.110.71.0.1 10.73.0.1 10.75.0.1 10.77.0.110.79.0.1 10.81.0.1 10.83.0.1 10.85.0.110.87.0.1 10.89.0.1 10.91.0.1 10.93.0.110.95.0.1 10.97.0.1 10.99.0.1 10.101.0.110.103.0.1 10.105.0.1 10.107.0.1 10.109.0.110.4.0.2 10.3.0.2VRF vpn3:Peer LDP Ident:10.14.14.14:0; Local LDP Ident 10.15.0.2:0TCP connection:10.14.14.14.646 - 10.15.0.2.11364State:Oper; Msgs sent/rcvd:1069/800; DownstreamUp time:02:38:52LDP discovery sources:ATM3/0/0.3Addresses bound to peer LDP Ident:10.3.36.9 10.7.0.1 10.14.14.14 10.13.0.110.15.0.1 10.17.0.1 10.19.0.1 10.21.0.110.23.0.1 10.25.0.1 10.27.0.1 10.29.0.110.31.0.1 10.33.0.1 10.35.0.1 10.37.0.110.39.0.1 10.41.0.1 10.43.0.1 10.45.0.110.47.0.1 10.49.0.1 10.51.0.1 10.53.0.110.55.0.1 10.57.0.1 10.59.0.1 10.61.0.110.63.0.1 10.65.0.1 10.67.0.1 10.69.0.110.71.0.1 10.73.0.1 10.75.0.1 10.77.0.110.79.0.1 10.81.0.1 10.83.0.1 10.85.0.110.87.0.1 10.89.0.1 10.91.0.1 10.93.0.110.95.0.1 10.97.0.1 10.99.0.1 10.101.0.110.103.0.1 10.105.0.1 10.107.0.1 10.109.0.110.4.0.2 10.3.0.2VRF vpn4:Peer LDP Ident:10.14.14.14:0; Local LDP Ident 10.17.0.2:0TCP connection:10.14.14.14.646 - 10.17.0.2.11366State:Oper; Msgs sent/rcvd:1199/802; DownstreamRouter#Table 1 describes the significant fields shown in the display.
Related Commands
Glossary
carrier supporting carrier—A situation where one service provider allows another service provider to use a segment of its backbone network. The service provider that provides the segment of the backbone network to the other provider is called the backbone carrier. The service provider that uses the segment of the backbone network is called the customer carrier.
CE router—customer edge router. A router that is part of a customer network and that interfaces to a provider edge (PE) router.
inbound label binding filtering—Allows LSRs to control which label bindings it will accept from its neighboring LSRs. Consequently, an LSR does not accept or store some label bindings that its neighbors advertise.
label—A short fixed-length identifier that tells switching nodes how to forward data (packets or cells).
label binding—An association between a destination prefix and a label.
LDP—label distribution protocol. The protocol used to distribute label bindings to LSRs.
LFIB—label forwarding information base. The data structure used by switching functions to switch labeled packets.
LIB—label information base. A database used by an LSR to store labels learned from other LSRs, as well as labels assigned by the local LSR.
LSP—label-switched path. A sequence of hops in which a packet travels from one router to another router by means of label switching mechanisms. A label-switched path can be established dynamically, based on normal routing mechanisms, or through configuration.
LSR—label switch router. A Multiprotocol Label Switching (MPLS) node that can forward native Layer 3 packets. The LSR forwards a packet based on the value of a label attached to the packet.
LVC—label VC. An ATM virtual circuit that is set up through ATM LSR label distribution procedures.
MPLS—Multiprotocol Label Switching. A switching method that forwards IP traffic using a label. This label instructs the routers and the switches in the network where to forward the packets based on preestablished IP routing information.
PE router—provider edge router. A router that is part of a service provider's network connected to a customer edge (CE) router. All MPLS VPN processing occurs in the PE router.
VCI—virtual channel identifier. A 16-bit field in the header of an ATM cell. The VCI, together with the VPI, is used to identify the next destination of a cell as it passes through a series of ATM switches on its way to its destination. ATM switches use the VPI/VCI fields to identify the next network VCL that a cell needs to transit on its way to its final destination.
VCL—virtual channel link. A connection between two ATM devices.
VPI—virtual path identifier. An 8-bit field in the header of an ATM cell. The VPI, together with the VCI, identifies the next destination of a cell as it passes through a series of ATM switches on its way to its destination. ATM switches use the VPI/VCI fields to identify the next VCL that a cell needs to transit on its way to its final destination.
VPN—virtual private network. Enables IP traffic to use tunneling to travel securely over a public TCP/IP network.
VRF—VPN routing and forwarding instance. An instance that consists of an IP routing table, a derived forwarding table, a set of interfaces that use the forwarding table, and a set of rules and routing protocols that determine what goes into the forwarding table.
Note
Copyright © 2005 Cisco Systems, Inc. All rights reserved.
