MPLS Network Implementation

MPLS (Multiprotocol Label Switching) is a data-carrying technique that directs data from one network node to the next based on short, fixed-length labels rather than long network addresses. It was standardized by the IETF (RFC 3031) to combine the speed of Layer 2 switching with the scalability of Layer 3 routing. Traditional IP routing requires every router to perform a longest-prefix match lookup on the destination IP address — a computationally expensive process that varies in time based on the size of the routing table. MPLS eliminates this by attaching a label to each packet at the ingress router; subsequent routers forward the packet by simply swapping labels, a fast and deterministic operation.

MPLS is not a single service but a framework that enables multiple applications: - Layer 3 VPNs (RFC 4364): Service providers offer isolated customer networks over a shared MPLS backbone. - Layer 2 VPNs (VPLS, VPWS): Emulate Ethernet or Frame Relay connections over MPLS. - Traffic Engineering (MPLS-TE): Explicitly route traffic to optimize bandwidth utilization and meet SLAs. - G-MPLS (Generalized MPLS): Extends MPLS to control time-division and wavelength-switched networks.

MPLS operates between Layer 2 and Layer 3, often called Layer 2.5. The core mechanism involves three types of devices: - Ingress LSR (Label Switch Router): Receives an unlabeled IP packet, performs a routing lookup, and pushes an MPLS label stack onto the packet. - Transit LSR: Receives a labeled packet, swaps the top label with a new one (label swap), and forwards it out the appropriate interface. - Egress LSR: Receives a labeled packet, pops the label (removes it), and forwards the original IP packet to its destination using standard IP routing.

A Label Switched Path (LSP) is the unidirectional path that a labeled packet follows from ingress to egress. LSPs are established using a label distribution protocol such as LDP (Label Distribution Protocol) or RSVP-TE (Resource Reservation Protocol with Traffic Engineering extensions).

An MPLS label is a 20-bit field embedded in a 32-bit shim header that sits between the Layer 2 header and the IP packet. The label header includes: - Label (20 bits): The actual label value, locally significant on each link. - Exp (Experimental, 3 bits): Used for QoS (Class of Service). Originally experimental, now used for MPLS QoS. - S (Bottom of Stack, 1 bit): Set to 1 for the last label in the stack; otherwise 0. - TTL (Time to Live, 8 bits): Copied from the IP TTL to prevent loops.

Label operations: - Push: Add a new label to the top of the stack. - Swap: Replace the top label with a new label. - Pop: Remove the top label. If the removed label was the bottom (S=1), the packet becomes an IP packet again.

Each LSR maintains an LFIB that maps incoming labels (interface + label) to outgoing actions (swap/pop and outgoing interface + label). When a labeled packet arrives, the router looks up the top label in the LFIB, performs the indicated operation, and forwards the packet. This is much faster than an IP routing lookup because the LFIB is indexed by the label (a fixed 20-bit value) rather than requiring a longest-prefix match.

LDP (RFC 5036) is the most common protocol for distributing labels in MPLS networks. It operates between directly connected LSRs to establish LSPs for every route in the IGP (e.g., OSPF, IS-IS). Key points:

MPLS-TE uses RSVP-TE to establish explicit LSPs that do not necessarily follow the IGP shortest path. This allows network operators to:

RSVP-TE messages include PATH (from ingress to egress) and RESV (from egress to ingress) to reserve resources. The path can be explicitly defined by the operator (strict or loose hops) or computed dynamically by a Path Computation Element (PCE).

In a Layer 3 MPLS VPN, the service provider's backbone carries customer routes using two labels: - Inner label (VPN label): Assigned by the egress PE (Provider Edge) to identify the customer VPN. - Outer label (transport label): Assigned by the ingress PE to forward the packet across the MPLS backbone to the egress PE.

Customer routers (CE) connect to PE routers. PEs run MP-BGP (Multiprotocol BGP) to exchange VPNv4 routes (IPv4 prefixes with an 8-byte Route Distinguisher) with other PEs. The VPNv4 routes carry VPN labels. P routers (Provider core) only see the transport label and have no customer route information, ensuring isolation.

Enable MPLS on an interface:

interface GigabitEthernet0/0
 mpls ip
 mpls mtu 1510

Configure LDP (optional, enabled by default with 'mpls ip'):

mpls ldp router-id Loopback0 force
mpls label protocol ldp

Configure MPLS-TE tunnel:

interface Tunnel1
 ip unnumbered Loopback0
 tunnel mode mpls traffic-eng
 tunnel destination 10.0.0.2
 tunnel mpls traffic-eng path-option 1 explicit name PATH1

Verification commands: - show mpls ldp neighbor — view LDP neighbors. - show mpls forwarding-table — view LFIB (label, outgoing interface, next hop). - show mpls ldp bindings — view label bindings. - show mpls traffic-eng tunnels — view TE tunnel status. - show ip route — verify IGP reachability. - ping mpls ipv4 10.0.0.2/32 — test MPLS LSP connectivity.

MPLS is the backbone of most service provider networks worldwide. Here are three common deployment scenarios:

1. Enterprise WAN Replacement with MPLS Layer 3 VPN A multinational company with 50 branch offices replaces its expensive Frame Relay/ATM WAN with an MPLS L3 VPN from a service provider. Each branch has a CE router connected to the provider's PE. The provider assigns each branch a VRF with a unique RD and RT. All branches can communicate via the provider's backbone without needing a full mesh of point-to-point links. The enterprise saves cost and gains any-to-any connectivity. Misconfiguration often involves incorrect RT import/export, causing routes to leak between customer VPNs or not being advertised at all. Also, overlapping customer IP addresses require careful RD allocation.

2. Traffic Engineering for Data Center Interconnect A cloud provider connects three data centers across a metro area using MPLS-TE. The IGP (OSPF) sees multiple equal-cost paths, but some links are congested while others are underutilized. The operator configures RSVP-TE tunnels that explicitly route traffic over less congested paths, reserving bandwidth for critical replication traffic. They also set up fast reroute (FRR) backup tunnels to protect against fiber cuts. Common pitfalls: misconfigured path options causing tunnels to not come up, or bandwidth reservation exceeding available capacity. Verification involves 'show mpls traffic-eng tunnels' and 'show ip rsvp reservation'.

3. Service Provider Core with MPLS and Segment Routing Migration A legacy ISP running MPLS with LDP decides to migrate to Segment Routing (SR-MPLS) to simplify operations. SR-MPLS uses the IGP (IS-IS or OSPF) to distribute labels, eliminating LDP sessions. The operator configures prefix-SIDs and adjacency-SIDs. The migration is done incrementally, with some routers running both LDP and SR. Interworking requires mapping between LDP and SR labels. Problems arise when SIDs are not unique or when the IGP does not propagate SIDs correctly. The operator uses 'show isis segment-routing label' to verify.