8/28/2014

Overview

MikroTik RouterOS
Training

Inter-Networking

BGP

BGP Basics (iBGP, eBGP)

Distribution, filtering and BGP attributes

MPLS

Introduction to MPLS

LDP

L2 and L3 VPN's

Traffic Engineering
2

Mikrotik 2012

Lab Setup

Lab Setup

X group number
AP SSID=AS100 band=2.4Ghz

Divide in groups by four

Make network setup as illustrated in next slide

192.168.x1.0/24

AS100
AP

10.20.0.1/24

R1 and R2 routes connect to AP with SSID

AS100 in 2.4Ghz band

192.168.x3.0/24
10.20.0.x1/24

R1 192.168.x.1/30

10.20.0.x2/24

Each router has local network 192.168.xy.0/24

where:

X-group number

Y-Routers number

192.168.x.2/30

R2

R3

192.168.x.5/30
192.168.x.9/30
192.168.x.6/30

192.168.x.10/30

R4

192.168.x2.0/24

Mikrotik 2012

Mikrotik 2012

192.168.x4.0/24

Autonomous system

Border Gateway Protocol

(BGP)

Mikrotik 2012

Internetworking

Set of routers under a single administrative

control
Routing exchange:

Routers within AS use common IGP

Routers between ASs use EGP

Has its own number (ASN)

Supports 16-bit value and 32-bit value

Numbers 64 512 65 534 reserved for private use

Mikrotik 2012

8/28/2014

BGP Basics

Path Vector Implementation

Stands for Border Gateway Protocol

Designed as Inter-AS routing protocol

Network topology is not exchanged, only

reachability information.

Hides network topology within an AS

Cannot provide loopfree routing within an AS

Only protocol that can handle Internet's size

networks

Treats whole AS as a single point in the path

Prefix is advertised with the list of ASs along the
path called AS path

Uses path vector algorithm

Mikrotik 2012

Mikrotik 2012

Path Vector Implementation

10.1.0.0/24

BGP Capabilities

Add AS100
to the path

AS100

AS200

Reject, AS100
already in
the path

Add AS200
to the path

Add AS300
to the path

BGP Speaker advertises supported capability codes

If received capability is not supported, remote peer
sends back notification
BGP speaker attempts to peer without unsupported
capability
Some of RouterOS advertised capabilities:

Route refresh

Multi-protocol extension

4-byte AS support

AS300

Mikrotik 2012

Mikrotik 2012

BGP Transport

10

Packet format

Operates by exchanging NLRI (network layer

reachability information).

NLRI includes a set of BGP attributes and one

or more prefixes with which those attributes are
associated

Uses TCP as the transport protocol (port 179)

Initial full routing table exchange between peers

Packet contains four main fields:

Marker (128bits) used for authentication

Length (16bits)

Type (8bits) BGP message type

Message body

Incremental updates after initial exchange

(maintains routing table version)
Mikrotik 2012

Internetworking

11

Mikrotik 2012

12

8/28/2014

BGP message types

BGP session and updates

Four message types:

Open with ASN4 capability

AS100

Open First message sent after TCP connection

establishment, contains capability list. Confirmed by
keepalive.

Keepalive

Update actual route updates. Contains:

NLRI

Path attributes

Route Refresh message

Update

Notification sent when error condition occurs,

contains error code and sub-code
13

14

Mikrotik 2012

Enable BGP

Indicates what networks BGP should originate from

the router.

/routing bgp instance

set default as=300 router-id=10.10.10.4

By default network is advertised only if corresponding

route is present in routing table

/routing bgp peer

add instance=default remote-address=10.10.10.1 remote-as=3000

Synchronization can be turned off if:

If router-id is not specified, it is automatically set to least IP address on

the router.

Your AS does not provide transit service

All the transit routers run BGP

Verify BGP connectivity. Any state other than established indicates that
routers can not become neighbors (use print status for more details)

Disabling sync allows BGP to converge faster.

Sync can be dangerous if routes are flapping a lot.

Configurable from
/routing bgp network
Mikrotik 2012

[admin@R1] /routing bgp peer> print

Flags: X - disabled, E - established
#
INSTANCE
REMOTE-ADDRESS
0 E default
10.10.10.1

15

REMOTE-AS
3000

16

Mikrotik 2012

Stub network Scenarios

AS200

AS100

Passive
BGP peer

Open without capability

Networks

AS200

Keepalive does not contain data, sent to keep

hold timer from expiring

Mikrotik 2012

Notification unsupported cap.

Private AS Removal

Single homed

Global net

Private ASN is used (>64511)

ISP originates only default route

Actually no need for BGP

Upstream ISP advertises networks

Stub network has the same policy as ISP

AS65500
ISP

172.16.0.0/24

172.16.0.0/16

ISP
0.0.0.0/0

Stub net

Private AS cannot be
leaked to public

AS65501
AS300

Available for eBGP

neighbors
Announce only aggregate route

172.16.1.0/24

AS65502
172.16.2.0/24

172.16.0.0/16

AS65500

Global net
AS300
Mikrotik 2012

Internetworking

172.16.0.0/24

Use following command

/routing bgp peer
set <peer-name> remove-private-as=yes

17

Mikrotik 2012

18

8/28/2014

BGP Lab I

BGP Lab I

Create BGP network setup as illustrated in next

slide:

X group number
AP SSID=AS100 band=2.4Ghz
BGP peer
AS100

BGP peer from R1 and R2 to AP

BGP peer from R2 to R4

BGP peer from R1 to R3

AP

192.168.x1.0/24

AS1x1

10.20.0.1/24

192.168.x3.0/24

R1 192.168.x.1/30

10.20.0.x1/24

10.20.0.x2/24

192.168.x.2/30

R2

Advertise your local network

Private ASN should be removed

Originate default route to private AS routers

192.168.x.6/30

192.168.x2.0/24

192.168.x.10/30

R4

AS65500

19

192.168.x4.0/24

Mikrotik 2012

Stub network Scenarios

Need to obtain AS number from ISP or RIR

Address range from Regional Internet Registry

Private ASN is used

Can be used:

Routing policy independent from ISPs

Can be used:

As main/backup link
Load sharing

Upstream ISP advertises networks

Stub network has the same policy as ISP

20

Non-stub Scenarios

Multihomed

AS65500

192.168.x.9/30

AS1x2

Mikrotik 2012

R3

192.168.x.5/30

ISP

Stub net

Global net

As main/backup link

Load sharing

More advanced
routing policies

AS200

AS100

R3

R1

172.16.0.0/16

AS65500

Global net
AS300

R2

172.16.0.0/24

AS300
Mikrotik 2012

21

Mikrotik 2012

BGP and connection tracking

BGP Lab II

Connection tracking is unable to keep valid

track of connections with multi-homed BGP.
Packets related to one connection can travel
through different paths

Do not drop invalid connections in firewall

Con-track should be turned off for better

performance

Mikrotik 2012

Internetworking

22

23

Add R3 to the same AS as R1

Add R4 to the same AS as R2

Make BGP peer between R4 and R3

Set up OSPF between routers in the same AS

Set OSPF to distribute connected routes

Announce both local networks from AS

Mikrotik 2012

24

8/28/2014

BGP Lab II
X group number
AP SSID=AS100 band=2.4Ghz
BGP peer
AS100
AP

BGP Lab II
192.168.x1.0/24

10.20.0.1/24

AS1x1

10.20.0.x1/24

192.168.x3.0/24

R1 192.168.x.1/30

10.20.0.x2/24

192.168.x.2/30

R2

R3

192.168.x.5/30
192.168.x.9/30
192.168.x.6/30

192.168.x.10/30

R4

AS1x2

[admin@R1] /ip route> print

Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#
DST-ADDRESS
PREF-SRC
GATEWAY
DISTANCE
0 ADb 0.0.0.0/0
10.20.0.1
20
1 ADC 10.20.0.0/24
10.20.0.11
R1_AP
0
2 ADC 192.168.1.0/30
192.168.1.1
R1_R3
0
3 ADo 192.168.1.8/30
192.168.1.2
110
4 ADC 192.168.11.0/24
192.168.11.0
local
0
5 Db 192.168.11.0/24
192.168.1.2
200
6 ADb 192.168.12.0/24
192.168.1.10
200
7 Db 192.168.12.0/24
10.20.0.12
20
8 ADo 192.168.13.0/24
192.168.1.2
110
9 Db 192.168.13.0/24
192.168.1.2
200
10 ADb 192.168.14.0/24
192.168.1.10
200
11 Db 192.168.14.0/24
10.20.0.12
20

192.168.x2.0/24

Mikrotik 2012

192.168.x4.0/24

25

26

Mikrotik 2012

BGP Lab II

Interior and Exterior BGP

[admin@R3] /ip route> print

Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#
DST-ADDRESS
PREF-SRC
GATEWAY
DISTANCE
0 ADb 0.0.0.0/0
192.168.1.1
200
1 ADo 10.20.0.0/24
192.168.1.1
110
2 ADC 192.168.1.0/30
192.168.1.2
R3_R1
0
3 ADC 192.168.1.8/30
192.168.1.9
R3_R4
0
4 ADo 192.168.11.0/24
192.168.1.1
110
5 Db 192.168.11.0/24
192.168.1.1
200
6 ADb 192.168.12.0/24
192.168.1.10
20
7 ADC 192.168.13.0/24
192.168.13.0
local
0
8 Db 192.168.13.0/24
192.168.1.1
200
9 ADb 192.168.14.0/24
192.168.1.10
20

iBGP peering between routers inside an AS

eBGP peering between routers from different ASs

AS200
R2

AS300

eBGP

AS100

R3

R1
R4
R5
R6

BGP redistributes only best route. Since on R1 best route is one received from R3,
router R1 does not redistribute .12/024 and .14.0/24 back to R3

iBGP

eBGP

AS400
Mikrotik 2012

27

eBGP

eBGP Multihop example

Lo: 10.1.1.1

Lo: 10.1.1.2

Almost always formed between directly

connected peers (AS edge routers).

AS100

AS200
R1

172.16.1.1
Eth1

Multi-hop configuration is required if peers are

not directly connected

Adds AS to advertised prefix's path

By default Next-hop is changed to self

28

Mikrotik 2012

172.16.1.2
Eth1

R2
Eth2

/routing bgp peer

add remote-address=10.1.1.x remote-as=x multihop=yes \
update-source=lo

Configuration requires static routes or enabled IGP so that the neighbors

can reach each other.
Setting eBGP to Loopback addresses can protect BGP from DOS attacks
Mikrotik 2012

Internetworking

29

Mikrotik 2012

30

8/28/2014

[admin@R1] /ip route> print

Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
#
DST-ADDRESS
PREF-SRC
GATEWAY
DISTANCE
0 ADb 0.0.0.0/0
10.20.0.1
20
1 ADb 10.1.101.0/24
10.20.0.1
20
2 ADC 10.20.0.0/24
10.20.0.11
ether1
0
3 ADC 192.168.1.0/30
192.168.1.1
ether2
0
4 ADC 192.168.11.0/24
192.168.11.1
dummy
0
5 Db 192.168.12.0/24
192.168.1.10 200
6 ADb 192.168.12.0/24
10.20.0.12
20
7 ADb 192.168.13.0/24
192.168.1.2 200
8 Db 192.168.14.0/24
192.168.1.10 200
9 ADb 192.168.14.0/24
10.20.0.12
20

iBGP

Next-hop is not changed by default:

Uses IGP (RIP,OSPF,static) to ensure network

reachability within an AS

Attributes learned from iBGP are not changed to

impact the path selection to reach outside network

AS path is not manipulated

Provides ways to control exit point from an AS

8 Db dst-address=192.168.14.0/24 gateway=192.168.1.10
gateway-status=192.168.1.10 unreachable distance=200 scope=40
target-scope=30 bgp-as-path="112" bgp-local-pref=100 bgp-origin=igp
received-from=peer2

Received external route from iBGP peer is not

propagated to other iBGP peers:

9 ADb dst-address=192.168.14.0/24 gateway=10.20.0.12

gateway-status=10.20.0.12 reachable ether1 distance=20 scope=40
target-scope=10 bgp-as-path="100,112" bgp-origin=igp
received-from=peer1

Requires full mesh between iBGP peers.

31

Mikrotik 2012

Loopback

BGP Lab III

Eliminates dependency from physical interface to

make TCP connection.

Mostly used between iBGP peers

In RouterOS empty bridge can be used as loopback

AS100

Add loopback address to OSPF networks

Set loopback address as ospf and bgp router-id

R2

R1
Eth1

Eth1

Improve your setup by using loopback

addresses between iBGP peers
10.255.x.y/32, where
x group number
y router's number

Lo: 10.1.1.1

Lo: 10.1.1.2

32

Mikrotik 2012

Eth2

/interface bridge add name=lo

/ip address add address=10.1.1.x/32 interface=lo
/routing bgp peer
add remote-peer=10.1.1.x remote-as=100 update-source=lo
Mikrotik 2012

33

Route Distribution

Distribution Example

IGP (Static, OSPF, RIP, connected) routes can

be redistributed

Prefix origin is incomplete

Risk of advertising all IGP routes

AS100

/ip route add dst-address=10.1.1.0/24 type=unreachable

/routing bgp instance set default redistribute-static=yes

Internetworking

R2

R1

Always use routing filters to avoid unwanted

route advertisements
Mikrotik 2012

10.1.1.0/24

AS200

/routing bgp instance

set default redistribute-static=yes
set default redistribute-ospf=yes

34

Mikrotik 2012

35

Packets will be ceased unless more specific

route is present
Good way to advertise supernet
Mikrotik 2012

36

8/28/2014

Routing Filters

Filter Chain example

/routing bgp instance set default out-filter=bgp-o
/routing bgp peer set peer1 out-filter=bgp-peer-o

Main tool to control and modify routing

information

/routing filter
add chain=bgp-o prefix=10.1.1.0/24 action=accept \
set-bgp-communities=30:30
add chain=bgp-o action=discard
add chain=bgp-peer-o prefix=10.1.1.0/24 action=passthrough \
set-out-nexthop=192.168.99.1

Organized in chains similar to firewall

Specify in BGP peer's configuration which
chains to use or BGP instance out filter
Prefix passes instance chain, then moves to
peer's
chain
/routing bgp peer set 0 in-filter=bgp-in out-filter=bgp-out

3 ADb dst-address=10.255.1.2/32 gateway=10.20.0.12

gateway-status=192.168.99.1 reachable ether2 distance=20 scope=40
target-scope=10 bgp-as-path="112" bgp-origin=igp
bgp-communities=30:30 received-from=peer2

/routing filter add chain=bgp-out prefix=10.1.1.0/24 \

action=discard invert-match=yes
37

Mikrotik 2012

Mikrotik 2012

Prefix filtering

38

AS Path filtering
10.1.1.0/24

AS100

AS400
R4

AS300

R1

R3

Can be configured to allow updates only to/from

certain AS
Supports regular expressions

10.1.2.0/24

. - any single character

^ - start of the as-path

$ - end of the as-path

_ - matches comma, space, start and end of as-path

AS200
R2

# config on R3
/routing bgp peer set peer1 out-filter=bgp-out

# config on R3

/routing filter add prefix=10.1.0.0/16 prefix-length=16-32 \

chain=bgp-out action=discard

/routing filter add chain=bgp-out action=discard \

bgp-as-path=_200_

Mikrotik 2012

39

Mikrotik 2012

BGP Soft Reconfiguration

BGP Lab IV

When action=discard is used, routes are not updated

after filter change.
Solution

Use action=reject to keep routes in the memory

Dynamic (Peer must support refresh capability):

Peer refreshes the routes after the changes are

done.

No additional memory is used

It is not done automatically - need to run

refresh command
Mikrotik 2012

Internetworking

40

41

Set up routing filters in the way that:

R1 does not receive 192.168.x2.0/24 prefix via AP

R2 does not receive 192.168.x1.0/24 prefix via AP

R3 does not receive 192.168.x4.0/24 prefix from R4

R4 does not receive 192.168.x3.0/24 prefix from R3

Mikrotik 2012

42

8/28/2014

BGP Lab IV

BGP decision algorithm

Lets look at R3. If set up properly traceroutes to network

x2 should go over R4 and traceroutes to x4 should go
over AP
[admin@R3] /ip address> /tool traceroute
src-address=192.168.13.1
# ADDRESS
RT1
1 192.168.1.6
4ms
2 192.168.12.1
3ms

192.168.12.1 \
RT2
4ms
4ms

RT3
4ms
4ms

STATUS

[admin@R3] /ip address> /tool traceroute 192.168.14.1 \

src-address=192.168.13.1
# ADDRESS
RT1
RT2
RT3
STATUS
1 192.168.1.1
2ms
2ms
2ms
2 10.20.0.12
3ms
4ms
4ms
3 192.168.14.1
6ms
6ms
6ms

BGP uses single best path to reach the

destination
BGP always propagates the best path to the
neighbors
Different prefix attributes are used to determine
best path, like weight, next-hop, as-path, localpref etc.
Setting peer to loopback address can force
BGP to install ECMP route (for load balancing).

43

Mikrotik 2012

44

Mikrotik 2012

Best path selection

Nexthop

Next-hop validation

Highest WEIGHT (default 0)

IP address that is used to reach a certain destination

Highest LOCAL-PREF (default 100)

For eBGP nexthop is neighbor's IP address

Shortest AS-PATH

eBGP advertised nexthop is carried into iBGP.

Locally originated path (aggregate, BGP network)

Lowest origin type (IGP,EGP,Incomplete)

Lowest MED (default 0)

AS100

Dst: 172.16.0.0/24
next-hop:10.1.1.1
Dst: 172.16.0.0/24
next-hop:10.1.1.1

R1 10.1.1.1
172.16.0.0/24

Prefer eBGP over iBGP

Prefer the route with lowest router ID or ORIGINATOR_ID

Shortest route reflection cluster (default 0)

Prefer the path that comesMikrotik

from 2012
the lowest neighbor address

10.1.1.2

10.30.1.1

45

# config on R2
/routing bgp peer set peer1 nexthop-choice=force-self

Dst: 172.16.0.0/24
next-hop:10.1.1.1

Weight is assigned locally to the router

Prefix without assigned weight have default value of 0

Route with higher weight is preferred

AS200

172.16.0.0/24
Weight=100

R2

172.16.0.0/24
Weight=50

10.30.1.2

AS200

Mikrotik 2012

R3

R1

R3

R2
10.30.1.1

Internetworking

AS100
Dst: 172.16.0.0/24
next-hop:10.30.1.1

172.16.0.0/24
10.1.1.2

46

Mikrotik 2012

Weight

Force BGP to use specific IP as a nexthop

R1 10.1.1.1

10.30.1.2

AS200

Nexthop self

AS100

R3

R2

AS300

47

Mikrotik 2012

48

8/28/2014

Local Preference

Indicates which path has preference to exit AS

Path with higher Local Pref is preferred (default: 100)

Advertised within AS 10.1.1.0/24

AS Path

List of AS numbers that an update has traversed.

AS200

AS300

AS100

AS200

R1

R5

R2

R3

10.1.1.0/24

AS-path:200,100

AS100

AS400

AS300
R4

R2

Local-pref = 200

AS-path:100

Local-pref = 100

R1

R4

R3

AS-path: 300,200,100
49

Mikrotik 2012

AS-Path Prepend

Origin

AS-Path manipulations can be used to influence

best path selection on upstream routers.

EGP route learned via Exterior Gateway protocol

Incomplete origin is unknown, occurs when route
is redistributed into BGP.

R2

51

MED

IGP interior or originating AS route.

AS300
Mikrotik 2012

R3

R1

172.16.0.0/24

Information of route origin:

AS200

AS100

Prepend = 2

172.16.0.0/24
AS-Path: 200,300

172.16.0.0/24
AS-Path: 100,300,300

50

Mikrotik 2012

52

Mikrotik 2012

MED Example

Multi Exit Discriminator or Metric hint to external

neighbor about path preference into an AS

AS300

AS100

Med=10

Med=0

R4

R1

Lower metric is preferred (Default: 0)

Med=50

Exchanged between AS and used to make decision inside

that AS, not passed to third AS.
Ignored if received from different ASs

Med=100

R3

R2

AS200

R1, R2 and R3 advertises the same network to R4 with different med

values. R4 only compares MEDs coming from R2 and R3, MED coming
from R1 is ignored (other attributes are used to select best path).

Mikrotik 2012

Internetworking

53

Mikrotik 2012

54

8/28/2014

BGP Lab V

Community

X group number
AP SSID=AS100 band=2.4Ghz

192.168.x1.0/24

AS100

Attribute that groups destinations

Filters can be easily applied to whole group

Default groups:

192.168.x1.0/24
AP

192.168.x3.0/24

AS1x1

R1

192.168.x2.0/24
192.168.x3.0/24

R2

R3

No-export do not advertise to eBGP peer

No-advertise do not advertise to any peer

Internet advertise to Internet community

192.168.x4.0/24
R4

AS1x2

192.168.x2.0/24

Local-as do not send outside local AS (in nonconfederation network the same as no-export)

192.168.x4.0/24

Use as-path prepend to set up BGP fail-over and load sharing as illustrated
55

Mikrotik 2012

Mikrotik 2012

Community Example

Community cont.

Assume that you don't want R2 to propagate routes

learned from R1
10.1.1.0/24
AS100

AS300
R3

AS200

R1

R2

32-bit value written in format xx:yy

Gives customer more policy control

Simplifies upstream configuration

Can be used by ISPs for:

# config on R1
/routing filter add chain=bgp-out action=passthrough \
set-bgp-communities=no-export

57

Mikrotik 2012

Community Example cont.

100:500 advertise to all peers

100:501 advertise to AS 400

10.1.1.0/24 community=100:500
10.2.2.0/24 community=100:501

AS prepending options

Geographic restrictions

Blackholing, etc.

Check Internet Routing Registry (IRR)

Mikrotik 2012

58

Community Example cont.

/routing filter
add prefix=10.1.1.0/24 action=accept\
chain=bgp-out-as100 set-bgp-communities=100:500
add prefix=10.2.2.0/24 action=accept\
chain=bgp-out-as100 set-bgp-communities=100:501

AS 400
# AS100 router config
/routing bgp peer set toAS500 out-filter=bgp-out-as500

ISP

/routing filter
add bgp-communities=100:501 action=discard\
chain=bgp-out-as500

AS100
AS300

AS 500

Mikrotik 2012

Internetworking

# AS300 router config

/routing bgp peer set toAS100 out-filter=bgp-out-as100

AS 100 defined public communities

56

59

Mikrotik 2012

60

10

8/28/2014

ISP example

Extended Communities

aut-num:
AS2588
as-name:
LatnetServiss-AS
descr:
LATNET ISP
member-of:
AS-LATVIA
remarks:
+-------------------------------------------------remarks:
|
remarks:
|
x=0 Announce as is
remarks:
|
x=1 Prepend +1
remarks:
|
x=2 Prepend +2
remarks:
|
x=3 Prepend +3
remarks:
|
x=4 Prepend +4
remarks:
|
x=5 Prepend +5
remarks:
|
remarks:
|
2588:400 Latvian Nets
remarks:
|
2588:500 Announce to LIX (Latvian Internet Exchange)
remarks:
|
2588:666 Don't announce (blackhole)
remarks:
|
2588:70x Announce to uplinks with $x prepend
remarks:
|
2588:900 Recieved from LIX (Latvian Internet Exchange)
remarks:
|
remarks:
|
For more information please use the email address
remarks:
|
iproute (at) latnet (dot) lv
remarks:
+--------------------------------------------------

Used to carry additional fields in L2VPN and

VPNv4 setups
Some additional fields carried:

Route Targets

Site of Origin

Control flags

MTU

Encapsulation flags

61

Mikrotik 2012

Aggregation

BGP Route Reflector

Summarization of more specific routes into supernet.

Can be used to hide topology.
Works only on the same instance BGP routes

Re-advertises iBGP routes to avoid full mesh

Reduces communication message count

Minimizes amount of data per message:

AS100

AS400

10.1.1.0/24

R1

10.0.0.0/8

R4

AS200

Mikrotik 2012

/routing bgp instance

set default client-to-client-reflection=yes
/routing bgp peer
add route-reflect=yes remote-peer=x.x.x.x ...

Divides AS into multiple ASs

To outside world confederation appears as single AS

Route-reflect should be enabled only on route

reflector router

RouterOS can not be configured as pure route

reflector

Internetworking

64

BGP Confederation

RR is configured by enabling client to client

reflection:

Mikrotik 2012

RR

Mikrotik 2012

Route Reflector Configuration

R2

R2
63

R3

R1

R3

R1

# config on R3
/routing bgp aggregate add instance=default summary-only=yes \
prefix=10.0.0.0/8 action=passthrough inherit-attributes=no

AS200

AS200
10.1.2.0/24

R2

Only best path is reflected

AS300
R3

62

Mikrotik 2012

65

Each AS must be fully meshed iBGP (or route

reflectors)
EBGP between confederation ASs exchange routing
like iBGP
AS-Path inside confederation is in scopes:
as-path=(30,20)

# confederation setup
/routing bgp instance set default confederation=100 \
confederation-peers=20,30
Mikrotik 2012

66

11

8/28/2014

BGP Confederation

Lab VI: Confederation

X group number
AP SSID=AS100 band=2.4Ghz

AS300

192.168.x1.0/24

AS100

AS200

R9

AS-Path: 100,300
R8

AP
R3

192.168.x3.0/24

Confederation
AS xx00

R4

R1

AS20
R1

AS-Path:(20,30)

AS10

R5

R2

AS400

AS1x1
R3

R2
R6

AS1x2
AS100

AS30

R4
192.168.x2.0/24

R7
Mikrotik 2012

67

Mikrotik 2012

Confederation AS-Path

68

MultiProtocol BGP

[admin@R1] /ip route> print detail

Flags: X - disabled, A - active, D - dynamic,

C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
...
8 ADb dst-address=192.168.12.0/24 gateway=192.168.1.10
gateway-status=192.168.1.10 recursive via 192.168.1.2
distance=200 scope=40 target-scope=30 bgp-as-path="(112)"
bgp-local-pref=100 bgp-origin=igp received-from=peer2

Mikrotik 2012

192.168.x4.0/24

69

BGP packet format is designed for Ipv4

Address family attribute was created to carry
new type of addresses.
RouterOS supported address families:

IPv6

L2VPN

VPN4

Cisco style L2VPN

Mikrotik 2012

70

BGP Instances

Each BGP instance runs its own BGP selection

algorithm

Routes between instances are elected by other

means (like distance)

Routes from one instance are not redistributed

automatically to another instance

Multi-protocol Label Switching

(MPLS)
LDP, VPNs (layer2,layer3), TE

Needs:
/routing bgp instance
set <id> redistribute-other-bgp=yes

BGP attributes are inherited from another

instance
Mikrotik 2012

Internetworking

71

Mikrotik 2012

72

12

8/28/2014

MPLS Lab Setup

X group number

AP SSID=AS100 band=2.4Ghz

MPLS Lab Setup

192.168.x1.0/24

AS100
AP

10.20.0.1/24

192.168.x3.0/24
10.20.0.x1/24

R1 192.168.x.1/30

Reset router's configuration

Set up configuration as illustrated

Lo:10.255.x.1
10.20.0.x2/24

Lo:10.255.x.2

192.168.x.2/30

R2

R3 Lo:10.255.x.3

192.168.x.5/30

Set up loopback addresses and run OSPF on

all links
Add loopback addresses to OSPF networks

192.168.x.9/30
192.168.x.6/30

192.168.x.10/30

R4

Lo:10.255.x.4

192.168.x2.0/24

192.168.x4.0/24

Mikrotik 2012

73

74

Mikrotik 2012

MPLS Basics

MPLS Basics

Technology used to forward packets, based on

short labels

LER Label Edge Router or Provider Edge router (PE)

LSR Label Switch Router or Provider router (P)

Packets are classified and

labeled at ingress LER

Initial goal: more efficient forwarding than IP

routing (similar to ATM switching)

LSRs forward packets

using label swapping

Serves as foundation for some Advanced

Services:

Layer3 VPNs

Any Transport over MPLS (AtoM), Layer2 VPNs

MPLS Traffic Engineering

Guaranteed bandwidth
services
Mikrotik
2012

75

Mikrotik 2012

MPLS Basics

Label is removed at
egress LER

MPLS
Backbone

MPLS Basics

Also called 2.5 layer protocol

More than one label is allowed.

Shim header (32 bit) placed between OSI Layer2

and Layer3:

Labels are grouped into label stack

LSRs always use the top label of the stack

Label (20 bits)

EXP (3 bits) - CoS

End of stack flag(1 bit) whether current label is the last in

the stack
TTL (8 bits)

L2

MPLS

Label

Mikrotik 2012

Internetworking

76

Several Label distribution methods exist:

LDP maps unicast IP destination into label

BGP external labels (VPN)

L3

EXP S TTL

77

Static Label mapping

RSVP,CR-LDP used for traffic engineering and

resource reservation
Mikrotik 2012

78

13

8/28/2014

Static Label Mapping

Static Label Mapping

Lo:1.1.1.1

RouterOS allows to add static local and remote

bindings for every destination.
MPLS dynamic label range must be adjusted to
free labels for static bindings.

/mpls
/mpls
/mpls
/mpls

Local:

set dynamic-label-range=100-1048575
local-bindings
remote-bindings
forwarding-table

Remote:

Fwd:

DST
1.1.1.1
2.2.2.2
3.3.3.3

Lo:2.2.2.2

LABEL
impl-null
22
23

DST
1.1.1.1
2.2.2.2
3.3.3.3

DST
1.1.1.1
2.2.2.2
3.3.3.3

LABEL
21
22
impl-null

DST
HOP LABEL
2.2.2.2 R2
impl-null
3.3.3.3 R2
23

DST
HOP LABEL
1.1.1.1 R1 impl-null
3.3.3.3 R3 impl-null

DST
HOP LABEL
2.2.2.2 R2
impl-null
1.1.1.1 R2
21

IN OUT DST
22
2.2.2.2
23 23 3.3.3.3

IN OUT DST
21
1.1.1.1
23
3.3.3.3

IN OUT DST
21 21 1.1.1.1
22
2.2.2.2

79

Mikrotik 2012

LABEL
21
impl-null
23

Lo:3.3.3.3

80

Mikrotik 2012

Test with traceroute

Static Mapping LAB

[admin@R1] /mpls forwarding-table> print

Flags: L - ldp, V - vpls, T - traffic-eng
#
IN-LABEL OUT-LABELS DESTINATION
INTERFACE NEXTHOP
0
expl-null
...
4 L 23
23
3.3.3.3/32
ether1
10.20.0.11
[admin@R1] >/tool traceroute 3.3.3.3 src-address=1.1.1.1
# ADDRESS
RT1
RT2
RT3
STATUS
1 10.20.0.11
2ms
1ms
2ms
<MPLS:L=23,E=0>
2 3.3.3.3
1ms
1ms
2ms

Create static label bindings for loopback

addresses
Since ECMP is not used in label binding,
choose only first gateway
Test if labels are set with traceroute:
/tool traceroute 10.255.1.1 src-address=10.255.1.3

81

Mikrotik 2012

LDP

Label space

Stands for Label Distribution Protocol

Relies on routing information provided by IGP

creates a local label binding to each IP prefix
and distributes to LDP neighbors

Remote bindings

IGP Prefix
10.1.1.0/24

10.1.1.0/24
Label 21

10.1.1.0/24
Label 22

82

Mikrotik 2012

10.1.1.0/24
Label 23

Per interface label space packet is forwarded

based on both the incoming interface and the
label
Per platform label space label is not unique
per interface
Label1
Path 1

Label1
Path 1

Path 1

Path 1

Path 2
Local binding
Label 21

Local binding
Label 22
Mikrotik 2012

Internetworking

Local binding
Label 23

Label1
Path 1

Label1
Path 2
83

Mikrotik 2012

84

14

8/28/2014

Distribution Modes

Well known numbers

Downstream-on-Demand (DoD) each LSR

requests its next-hop label binding.
(Not yet implemented)

Unsolicited Downstream (UD) LSR distributes

a binding all adjacent LSRs even if LSRs are
requesting a label.

Mikrotik 2012

85

Can be configured in /mpls ldp menu

Setting transport address ensures proper

penultimate hop popping behavior

Mikrotik 2012

Hellos are sent to all routers in this subnet

multicast address (224.0.0.2)

86

LDP Lab

/mpls ldp set enabled=yes transport-address=x.x.x.x \

lsr-id=x.x.x.x
/mpls ldp interface add interface=ether1

LDP transport session establishment TCP port

646

Mikrotik 2012

Configuring LDP

LDP Hello messages UDP port 646

87

Remove all static mapping from previous lab

Enable LDP and set lsr-id and transport
address the same as loopback address
Add LDP interfaces connecting neighbor routers
Verify if LDP neighbors are created
/mpls ldp neighbor print
Check MPLS forwarding-table
/mpls forwarding-table print
88

Mikrotik 2012

Reserved Labels

Labels from 0 to 15 are reserved, but only 4 are

used at this point:

0 explicit NULL

1 router alert

2 Ipv6 explicit NULL

3 implicit NULL

PHP

PHP

Mikrotik 2012

Internetworking

Implicit NULL

89

Mikrotik 2012

Explicit NULL

90

15

8/28/2014

Penultimate Hop Popping

Explicit NULL

Router is egress point for network that is

directly connected to it, next hop for traffic is not
MPLS router

Advertised with implicit null label

Penultimate hop popping ensures that routers

do not have to do unnecessary label lookup
when it is known in advance that router will
have to route packet

Implicit NULL is used by default

It will give false increase in latency for that hop

Label: 23

92

Targeted LDP Sessions

ICMP error messages are switched further

along LSP

Label: 12

Not required if stack contains at least two labels

(inner label can still carry QoS value)

Mikrotik 2012

MPLS Traceroute

Useful to preserve QoS

91

Mikrotik 2012

If configured, penultimate LSR forwards packet

with NULL label, instead of popping stack.

In some cases it is necessary to set up targeted

LDP session (session between not directy
connected LSRs)
Configuration:
/mpls ldp neighbor add transport=<remote_ip> \
send-targeted=yes

Label: 34

Targeted LDP
R1

R2

R3
Label: 32

R4
LDP

Label: 43

Mikrotik 2012

93

Two types of binding filters:

Which bindings should be advertised
/mpls ldp advertise-filter

94

Label Binding LAB

Can be used to distribute only specified sets of

labels to reduce resource usage

LDP

Mikrotik 2012

Label Binding Filtering

LDP

Which bindings should be accepted

/mpls ldp accept-filter

Filters are applied only to incoming/outgoing

advertisements. Any changes to filters requires
ldpldp
disable/enable
/mpls
advertise-filter add prefix=9.9.9.0/24 advertise=yes

Set up label binding filters so that only bindings

to loopback addresses from your group are sent
and received.
Check forwarding table to make sure filters
worked
Check if packets are label switched or L3
forwarded with traceroute

/mpls ldp advertise-filter add prefix=0.0.0.0/0 advertise=no

Mikrotik 2012

Internetworking

95

Mikrotik 2012

96

16

8/28/2014

VRF

Virtual Routing and Forwarding

Based on policy routing

Layer3 VPN
VRF

Mikrotik 2012

98

Mikrotik 2012

Static Inter-VRF route:

Explicitly specified routing table (works with main)

/ip route
add gateway=10.3.0.1@main routing-mark=vrf1

When nexthop resolving fails it is not resolved

in main table (compared to policy routing)

VRF and Router Management

Route leaking is route exchange between

separate VRFs

Multiple VRFs solves the problem of

overlapping customer IP prefixes

97

Route Leaking

Functionality of completely independent routing

tables on one router.

Any router management is not possible from vrf

side (winbox, telnet, ssh ...)
Ping and traceroute tools are updated to
support VRFs
OSPF and BGP can be used as CE-PE protocol

Explicitly specify interface

/ip route
add dst-address=5.5.5.0/24 gateway=10.3.0.1%ether2 \
routing-mark=main

Mikrotik 2012

99

BGP/MPLS IP VPN

Works in Layer3 unlike BGP based VPLS.

Also called L3VPN

100

Mikrotik 2012

L3VPN
VPN A
Site 1

RR

CE

CE

VPN B
Site 2

Multiprotocol BGP is used to distribute routes

between VRFs even in router itself.

PE

PE
CE

Provider network MUST be MPLS enabled

VPN B
Site 1

CE
PE

VPN A
Site 2
CE

BGP
OSPF as CE-PE
Mikrotik 2012

Internetworking

101

VPN B
Site 3
Mikrotik 2012

VPN A
Site 3
102

17

8/28/2014

Route Distinguisher

Route Target

Route distinguisher (RD) is used to make IPv4

prefixes unique

RD+IPv4 prefix=vpnv4 prefix

Format

IP:num

ASn:num

Note: Some complex scenarios may require

more than one RD by VPN

Route Targets (RTs) were introduced for the

ability to have interconnection between the sites
of different companies, called extranet VPNs.
Route Targets are BGP extended community to
specify what vpnv4 prefixes will be imported into
VRF table.
Exporting RT - vpnv4 receives an additional
BGP extended community
Importing RT received vpnv4 route is checked
for a matching RT

103

Mikrotik 2012

Route Target
VPN B
Site 1 CE

Configuring L3VPN
CE

VPN A
Site 1

Configure BGP to use VRF and vpnv4 address

family
/routing bgp instance vrf

Import: 100:3
100:2
Export: 100:1

Import: 100:1
Export: 100:3

add instance=default routing-mark=vrf1 \

redistribute-connected=yes
/routing bgp peer
add address-families=vpnv4 update-source=lo ...

CE

Import: 100:2
Export: 100:4

CE

VPN B
Site 2

Mikrotik 2012

105

VPNV4 Lab

Create VRF instance

/ip route vrf

add routing-mark=vrf1
route-distinguisher=100:1
export-route-targets=100:1
import-route-targets=100:1

Import: 100:1
100:4
Export: 100:2

VPN A
Site 2

Results
/routing bgp vpn vpnv4-route
print
Mikrotik 2012

Choose Route Reflector and set up iBGP (group AS:

X00)

AP SSID=AS100 band=2.4Ghz

Blue 192.168.x1.0/24
Site 1

AS100

Set up VPNV4 BGP

106

VPNV4 Lab

BGP peers

X group number

RR

AP

104

Mikrotik 2012

Create VRF with interface where your laptop is

connected

192.168.x3.0/24

R1

Green
Site 2

Lo:10.255.x.1

Route Distinguisher and export RT: X00:Y

Set up proper import route targets, so that only Green
sites and Blue sites exchange routes (see next slide)
Set up route leaking to access internet from VRF

Lo:10.255.x.2

Internetworking

107

GroupAS: X00

Green
Site 1
192.168.x2.0/24

Mikrotik 2012

R2

R3 Lo:10.255.x.3

R4

Lo:10.255.x.4

Mikrotik 2012

Blue
Site 2
192.168.x4.0/24

108

18

8/28/2014

OSPF and eBGP as CE-PE

Distributes routes between CE and PE router's VRF

On PE router specify which VRF to use

/routing ospf instance

set default routing-table=vrf1 redistribute-bgp=as-type-1

Layer 2 VPN

New instance to use eBGP as CE-PE

LDP Based VPLS

/routing bgp instance

add name=ebgp as=100 routing-table=vrf1

AP
CE

CE-PE BGP
instance

BGP Based VPLS

CE-PE BGP
instance

AP
CE

BGP peer
PE

PE

MPLS Cloud
CE

CE

OSPF

Mikrotik 2012

OSPF

109

LDP based VPLS

Also called L2VPN or EoMPLS

Glues together individual LANs across MPLS

Uses LDP to negotiate VPLS tunnels

LDP based VPLS

PW label

Customer's L2 frame

SN label
L2 header

Site 1
CE1

PE1

Pseudowire demultiplexor field (PW label) is

used to identify VPLS tunnel

PE2

Site 3
P1
CE3

Pseudowire has MAC learning, flooding and

forwarding functions

PE3

MPLS backbone
Pseudo wire

Site 2

CE - customer's edge router

PE - provider's edge router
P Provider's core router

CE2

Mikrotik 2012

111

Mikrotik 2012

Configuring VPLS

110

Mikrotik 2012

112

Configuring VPLS

Add VPLS tunnel termination points:

/interface vpls
add remote-peer=x.x.x.x vpls-id=x:x

Add VPLS tunnel termination points:

/interface vpls
add remote-peer=x.x.x.x vpls-id=x:x

Dynamic targeted LDP neighbor is added

Dynamic targeted LDP neighbor is added

VPLS tunnel ID must be unique for every VPLS

VPLS tunnel ID must be unique for every VPLS

Related VPLS tunnel information can be viewed

by /interface vpls monitor command
Bridge VPLS interface with local one to provide
transparent connectivity
Mikrotik 2012

Internetworking

113

Related VPLS tunnel information can be viewed

by /interface vpls monitor command
Bridge VPLS interface with local one to provide
transparent connectivity
Mikrotik 2012

114

19

8/28/2014

Split Horizon

LDP VPLS Lab

Forward Ethernet frame coming from PE to connected CEs

Packets are not forwarded to interfaces with the same

horizon value

Horizon value is set in bridge port configuration

/interface bridge port
add bridge=vpn interface=vpls1 horizon=1
CE1
1

Bridge VPLS interfaces with local interface on

your router.

VPN network is 192.168.x0.0/24 where:

Set up Split horizon to avoid loops

Test connectivity between laptops in your group

CE3
PE1

Create VPLS tunnels between all routers from

the group (VPLS ID x:x)

PE3

x - group number

CE2

CE4

PE2
115

Mikrotik 2012

LDP VPLS Lab

LDP VPLS Lab

VPLS tunnel

X group number

Create VPLS tunnels between all routers from

the group (VPLS ID x:x)

AP SSID=AS100 band=2.4Ghz

192.168.x0.1/24

Site 1

AS100

Bridge VPLS interfaces with local interface on

your router.

RR

AP
VPN network:
192.168.x0.0/24

Lo:10.255.x.2

x - group number

Set up Split horizon to avoid loops

Test connectivity between laptops in your group

117

Mikrotik 2012

[admin@R4] /mpls ldp neighbor> print

Flags: X - disabled, D - dynamic, O - operational, T - sendingtargeted-hello, V - vpls
#
TRANSPORT LOCAL-TRANSPORT PEER SEND-TARGETED ADDRESSES
0 DOTV 10.255.0.3 10.255.0.4 10.255.0.3:0 no
10.255.0.3
192.168.1.2
1 DOTV 10.255.0.2 10.255.0.4
10.255.0.2

10.255.0.2:0

no

10.20.0.12

2 DOTV 10.255.0.1 10.255.0.4

10.255.0.1:0

yes

10.20.0.11
10.255.0.1

Site 4
192.168.x0.4/24

118

LDP based VPN drawbacks

119

R4

Lo:10.255.x.4

Mikrotik 2012

[admin@R4] /interface vpls> monitor 0

remote-label: 40
local-label: 28
remote-status:
transport: 10.255.0.1/32
transport-nexthop: 192.168.1.9
imposed-labels: 22,40

Internetworking

R3 Lo:10.255.x.3

R2

Site 2
192.168.x0.2/24

Mikrotik 2012

192.168.x0.3/24

Site 3

R1

Lo:10.255.x.1

VPN network is 192.168.x0.0/24 where:

116

Mikrotik 2012

Scalability issues due to static nature

Requirement to maintain full mesh of LDP
tunnels
Configuration adjustment on all routers forming
VPLS

Mikrotik 2012

120

20

8/28/2014

L2/MPLS MTU Importance

L2MTU: 1500

Eth(14) IP(20)

DATA(1480)

MPLS MTU = IP MTU (L3) + MPLS headers

R1

MPLS MTU is adjustable from

/mpls interface menu

L2MTU: 1526

Then generate ICMP Need Fragment error

Else silently discard packet

Eth(14) VLAN(4) MPLS(4)

IP(20)

DATA(1480)
R2

If MTU is too large and next header is IP

Eth(14) MPLS(4)VPLS(4) CW(4) Eth(14) IP(20)

L2MTU: 1526

Eth(14) MPLS(4)VPLS(4) CW(4) Eth(14) IP(20)

DATA(1480)

L2MTU: 1522

Eth(14) VPLS(4) CW(4) Eth(14) IP(20)

DATA(1480)

R3

DATA(1480)

IP (L3) MTU

R4

MPLS MTU

L2MTU: 1500

L2 MTU

Eth(14) IP(20)

DATA(1480)

Full Frame
Mikrotik 2012

121

Mikrotik 2012

122

Mikrotik 2012

124

VPLS Control Word

4-byte Control Word (CW) is used for packet

fragmentation and reassembly inside VPLS
tunnel
Optional CW is added between PW label and
packet payload
CW can be turned off for compatibility with other
vendors (some Cisco BGP based VPLS)

Mikrotik 2012

123

BGP Based VPLS

BGP VPLS functionality

Autodiscovery no need to configure each VPLS

router
Signaling labels for VPLS tunnels distributed in
BGP updates.

No need for targeted LDP sessions

No scalability issues

BGP Based VPLS configuration

Internetworking

Enable l2vpn in BGP peer's address-families

to use BGP multi protocol capability
Use loopback address as BGP peers address
by specifying update-source, in order for
penultimate hop popping to work properly.
/routing bgp peer
add remote address=1.1.1.1 remote-as=100 update-source=lo
address-families=l2vpn

No significant advantages over LDP in case of

full mesh BGP.
Mikrotik 2012

Configure BGP instance

125

Mikrotik 2012

126

21

8/28/2014

BGP Based VPLS configuration

Configure VPN bridge

Configure BGP signaled VPLS interface

BGP based VPLS Lab

/interface vpls bgp-vpls

add bridge=<bridge> bridge-horizon=1 site-id=1 \
route-distinguisher=1:1 import-route-targer=1:1 \
export-route-target=1:1

Dynamic VPLS tunnel gets created and added

to bridge ports

route-distinguisher value that gets attached to VPLS

NLRI to distinguish advertisements, value should be
unique for each VPLS

site-id unique setting among members of particular

VPLS
Mikrotik 2012

Choose which one of routers will be Route

reflector (for example R1)
Set BGP peering only between RR
Replace all statically created VPLS with BGP
VPLS
Set import/export route targets the same as
route distinguisher.

127

128

Mikrotik 2012

IP Routing Limitation

Traffic Engineering

After two IP traffic flows for the same

destination are merged, it is impossible to split
them and reroute over different paths
Overloaded link from Router C to Router E
A

D
40Mbps traffic from A to F
B

129

Mikrotik 2012

Mikrotik 2012

TE solves the problem

Can be used to steer traffic to less utilized links

D
B

130

Traffic Engineering

Traffic Engineering

40Mbps traffic from B to F

Expands the capabilities of L2 ATM and Frame

relay networks
Constraint based routing - path for the traffic
flow is shortest path that meets resource
requirements (constraints)
Eliminates the need of overplayed L2 mesh.

TE Tunnel1 50Mbps
TE Tunnel2 50Mbps

Mikrotik 2012

Internetworking

131

Mikrotik 2012

132

22

8/28/2014

How it works

TE Tunnel Path Options

TE establishes/maintains the tunnel using

RSVP (Resource Reservation Protocol)

Tunnel path: use-cspf=no and empty hops

Tunnel path at any point is determined based

on network resources and tunnel requirements
Available resources are flooded via OSPF

133

Auto TE works within the range of one area

Traffic can be forwarded automatically to TE if

TE configuration

Remote endpoint of pseudowire is the same as TE

endpoint
BGP nexthop is tunnel endpoint ( can be turned off
by setting use-te-nexthop=no)

Mikrotik 2012

136

Mikrotik 2012

TE configuration

TE tunnel path and reservation state

[admin@R2] /mpls traffic-eng path-state> print

Flags: L - locally-originated, E - egress, F - forwarding, P - sendingpath, R - sending-resv
#
SRC
DST
BANDWIDTH OUT.. OUT-NEXT-HOP
0 LFP 10.255.1.2:1
10.255.1.3:3 10.0Mbps R2_R4 10.20.0.11
[admin@R2] /mpls traffic-eng resv-state> print
Flags: E - egress, A - active, N - non-output, S - shared
#
SRC
DST
BANDWIDTH LABEL INT...
0 AS 10.255.1.2:1
10.255.1.3:3
10.0Mbps 124
R2_R4

TE tunnel monitoring
[admin@R2] /interface traffic-eng> monitor 0
tunnel-id: 3
primary-path-state: established
primary-path: rt
secondary-path-state: not-necessary
active-path: rt
active-lspid: 1
active-label: 124
recorded-route: 192.168.1.1[124],192.168.1.2[0]
reserved-bandwidth: 10.0Mbps

[admin@R2] /mpls traffic-eng interface> print

Flags: X - disabled, I - invalid
#
INTERFACE
BANDWIDTH
0
R2_R1
50Mbps
1
R2_R4
50Mbps

[admin@R2] /interface vpls> monitor 0

remote-label: 114
local-label: 113
remote-status:
transport: traffic-eng1
transport-nexthop: 10.20.0.11
imposed-labels: 124,114

Internetworking

Configure TE tunnel itself

/mpls traffic-eng tunnel-path

add use-cspf=no name=rt
/interface traffic-eng
add bandwidth=10Mbps primary-path=rt
from-address=10.255.1.2 to-address=10.255.1.3

135

OSPF Result (should have opaque LSAs)

Mikrotik 2012

Set OSPF to use TE and configure TE on all

interfaces participating in TE tunnel

/routing ospf set mpls-te-area=backbone

mpls-te-router-id=loopback
/mpls traffic-eng interface
add interface=ether1 bandwidth=50Mbps

TE configuration

134

Mikrotik 2012

How it works
Tunnel head end appears as interface

Constrained Shortest Path First (CSPF) head

end router calculates path to tail end using
knowledge of network state. Needs assistance
form IGP.
Tunnel path: use-cspf=yes, empty hops or explicitly
configured hops

RSVP TE tunnels are unidirectional

Statically configured explicit path

Tunnel path: use-cspf=no hops=<explicit hop config>

Tunnel paths are calculated at the tunnel head

based on a fit between required and available
resources (constraint-based routing)
Mikrotik 2012

Tunnel path is routed based on routing table

137

Mikrotik 2012

TE-METRIC REMAINING-BW
1
50.0Mbps
1
40.0Mbps

138

23

8/28/2014

Static Path

Static path example

10.1.3.1

Static path is established by setting strict or loose

hops:

10.1.1.1
A

Strict - defines that there must not be any other hops

between previous hop and "strict" hop (fully specified
path)

10.1.4.1

D
B

Loose - there are acceptable other hops between

previous hop and defined hop (not fully specified path).

10.1.2.1

10.1.0.1
10.1.2.1:loose

/mpls traffic-eng tunnel-path

add use-cspf=no \
hops=10.1.1.1:strict,10.1.3.1:loose,10.1.4.1:strict

Mikrotik 2012

10.1.1.1:strict,10.1.2.1:strict, 10.1.4.1:loose
10.1.1.1:strict,10.1.2.1:strict,10.1.3.1:strict,10.1.4.1:strict

139

TE Lab I

140

Mikrotik 2012

TE Lab I

VPLS tunnel

X group number
AP SSID=AS100 band=2.4Ghz

Set up TE tunnels so that VPLS tunnels uses

following switching paths:

192.168.x0.1/24

Site 1

AS100
RR

AP

VPLS: R1<->R4; TE Path: R1-R3-R4 primary

VPLS: R2<->R3: TE Path: R2-R4-R3 primary

VPN network:
192.168.x0.0/24

192.168.x0.3/24

Lo:10.255.x.1

Experiment with different TE path types.

Lo:10.255.x.2

R3 Lo:10.255.x.3

R2

Site 2

R4

192.168.x0.2/24

Mikrotik 2012

141

Manually (optimize command);

Automatically (at configuredreoptimize-interval)

Switching paths may take some time, depends

on: OSPF timeouts, routing table updates, TE
timeout settings.

Internetworking

192.168.x0.4/24

142

By default TE tunnels do not apply rate limitations,

bandwidth settings are only for reservation accounting
To make tunnels more flexible two features were added:

TE tries to switch back to primary every minute

(can be changed by primary-retry-interval)

Mikrotik 2012

Site 4

Auto Bandwidth

TE does not switch paths automatically to

secondary, tunnel must be reoptimized:

Lo:10.255.x.4

Mikrotik 2012

Secondary TE Tunnel Path

Site 3

R1

143

bandwidth-limit hard rate limit allowed to enter the

tunnel, limit is percent of tunnel bandwidth.
Auto bandwidth adjustment measures average rate
during auto-bandwidth-avg-interval, tunnel keeps
highest avg rate seen during auto-bandwidth-updateinterval. When update interval expires, tunnel chooses
new highest rate from auto-bandwidth-range.

Both options can be used in combination.

Mikrotik 2012

144

24

8/28/2014

TE Lab II

TE Lab II

VPLS tunnel

X group number
AP SSID=AS100 band=2.4Ghz

Set up TE tunnels so that VPLS tunnels uses

following primary and backup switching paths:

192.168.x0.1/24

Site 1

AS100
RR

AP

VPLS: R1<->R4; TE Path: R1-R3-R4 primary, R1R2-R4 backup

VPLS: R2<->R3: TE Path: R2-R1-R3 primary, R2R4-R3 backup

Set up TE tunnel bandwidth limit (automatic and

static) and test limitation with bandwidth test.

VPN network:
192.168.x0.0/24

145

Site 3

Lo:10.255.x.1

Lo:10.255.x.2

R3 Lo:10.255.x.3

R2

Site 2
192.168.x0.2/24

Mikrotik 2012

192.168.x0.3/24

R1

R4

Lo:10.255.x.4

Mikrotik 2012

Site 4
192.168.x0.4/24

146

Overall Summary

MPLS improves performance

Very easy to enable over existing core
configuration

Very easy to migrate from EoIP to VPLS

New possibilities for ISPs to offer new services

Mikrotik 2012

Internetworking

147

25