Cisco Systems OL-4344-01 manual

CH A P T E R 1-1 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 1 About Cisco IP Solution Center Cisco IP Solution Center (ISC) is a car rier- class ne two rk and service-management solution for the rapid and cost-effecti ve deli very of IP services. IP based services target ed to enterprise customers can represent m[...]

1-2 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center Overview of ISC The notable ISC network elements are as follows: • ISC Network Mana gement Su bnet The ISC Network Mana gement Su bnet is required when the service pro vider’ s service offering entails the ma nagement of [...]

1-3 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center Overview of ISC It is not required that the set of IPv4 addresses us ed in any two VPNs be mutual ly exclusi v e because the PEs translate IPv4 ad dresses into IPv4 VPN enti ties by using MP-BGP with exte nded community attrib[...]

1-4 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center Overview of ISC • VLAN ID Management : ISC allocates VLAN IDs per customer and per Et hernet Service deployed. The service provider can track per Access Domain a pa rticular allocated VLAN ID (per service or per customer or[...]

1-5 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center Overview of ISC Figur e 1 -3 Access Do main Assigned 2. All the network elements hav e been discov ered dur ing the Autodiscov ery process, as well as the network topol ogy (connect i vity betw een sites). 3. The service opera[...]

1-6 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center Overview of ISC • Route Distinguisher (RD) pool : The IP subnets advert ised by the CE routers to the PE routers are augmented with a 64-bit pref ix called a route dist inguisher (RD) to make them unique. The resulti ng 96-[...]

1-7 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center Overview of ISC • VRF confi guration (exp ort map, import map, maximum number of routes, VRF and RD o verride, and so forth) • Choice of joining t he VPN as hub or spoke • Choice of interf aces on the PE, CE, and interme[...]

1-8 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center Overview of ISC Figur e 1 -4 Defining the User Role The permissions to Create, V ie w , Modify , a nd De lete are enforced for the follo wing resources: PENDING DEPLOYED FUNCTIONAL BROKEN 93827 LOST REQUESTED WAIT DEPLOY FAIL[...]

1-9 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center The Customer’s and Provider ’ s View of the Netw ork The Customer’s and Provider’s View of the Network From the customer’ s point of vie w , they see their internal routers communicating with their customer edge rout[...]

1-10 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center The Customer’s and Provider’s View of the Network Figur e 1 -6 Service Provider’ s View of the Networ k About Provider Edge Routers (PEs) At the edge of the provider network are provider ed ge routers (PEs). Wi thin th[...]

1-11 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center The Customer’s and Provider ’ s View of the Netw ork A Multi-VRF CE is unlik e a CE in that there is no label e xchange, no LDP ad jacency , and no labeled packet flo w between the PE a nd the CE. Multi-VR F CE routers us[...]

1-12 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center Using Templates to Custom ize Configuration Files Mapping IPsec Tunnels to MPLS VPNs Provisio ning network-based IPsec VPNs in order to map IPsec tunn els to MPLS VPNs in v olves bo th MPLS and IPsec services in IP Solutions[...]

1-13 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center Using Templates to Custom ize Configuration Files The template fi les and data f iles are in XML format. The template f ile, its data f iles, and all templat e configuration f ile fi les are ma pped to a single directory . ?[...]

1-14 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center About MPLS VPNs • Audit Existing Services : Checks and ev aluates conf igurat ion of deployed service to see if the service is still in ef fect. • Audit Routing Reports : Checks the VRF f or the VPN on t he PE. This repo[...]

1-15 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center About MPLS VPNs Characteristics of MPLS VPNs MPLS VPNs have the follo wing characteristics: • Multiprotocol Border Gate w ay Protocol-Multiprot ocol (MP-BGP) extension s are used to encode customer IPv4 address pref ix es i[...]

1-16 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center About MPLS VPNs VPN Routing and Forwarding Tables (VRFs) The VPN routing and forw arding table (VRF) is a ke y element in the MPLS VPN technolog y . VRFs exist on PEs only (ex cept in the case of a Multi -VRF CE). A VRF is a[...]

1-17 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center About MPLS VPNs Figur e 1 - 9 VRFs for Sites i n Multiple VPNs VRF Implementation Considerations When implementing VPNs and VRFs, Cisco recommend s you keep the foll owin g considerations in mind: • A local V RF inter face [...]

1-18 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center About MPLS VPNs • The MPLS VPN backbone relies on the appropr iate Interior Gate wa y Protocol (IGP) that is configured for MPLS, fo r example, EIGRP , or OSPF . When you issue a show ip r oute command on a PE, you see the[...]

1-19 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center About MPLS VPNs ISC chooses route tar get v alues by default, b ut you can o verr ide the automatically assigned R T values if necessary when you first define a CERC in the ISC software (see the “Def ining CE Routing Commun[...]

1-20 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center About MPLS VPNs ISC supports multiple CEs pe r site and multiple site s connected to the same PE. Each CERC has unique route targ ets (R T), route distinguisher (RD) and VRF naming. Aft er provisio ning a CERC, it is a good [...]

1-21 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center Security Requirements for MPLS VPNs Security Requirements for MPLS VPNs This section discusses the security requirements for MPLS VPN archit ectures. This section concentrates on protecting the core netw ork against attacks f[...]

1-22 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center Security Requirements for MPLS VPNs Gi ven addressi ng and routing separati on across an MPLS core network , MPLS of fers in thi s respect the same security as comparable Layer 2 VPNs, such as A TM or Frame Relay . It is not[...]

1-23 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center Security Requirements for MPLS VPNs Resistance to Attacks It is not possible to d irectly intrude into other VPNs. Ho we v er , i t is possible to attack the MPLS core, and try to attack other VPNs from there. There are two b[...]

1-24 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center Security Requirements for MPLS VPNs In practice, access to the PE router o ver the CE-PE int erface can be limi ted to the required rou ting protocol b y using access control lists (A CLs). This limits the point of attack to[...]

1-25 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center Security Requirements for MPLS VPNs For security reasons, a PE router should ne ver accep t a p acket with a label fr om a CE router . Cisco routers implementation is such that pack ets that arri ve on a CE interface with a l[...]

1-26 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center Security Requirements for MPLS VPNs • PE-P link: use LDP MD5 authen tication • P-P This pre vents att ackers from spoof ing a peer rout er and introducin g bogus routing infor mation. Secure management is particularly im[...]

1-27 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center Security Requirements for MPLS VPNs From a security point of vie w , the merged VPNs beha ve like one logical VPN, and the security mechanisms described abov e apply now between th e merged VPN and other VPNs. The mer ged VPN[...]

1-28 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center Security Requirements for MPLS VPNs The forwarding table for a PE contains only addre ss entries for members of the sa me VPN. The PE rejects requests for addresses not listed in its forw ard ing table. By implementing a log[...]

1-29 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center Security Requirements for MPLS VPNs • Layer 2 VPN Service • MPLS VPN Service • In v entory • IPsec VPN Service • FireW all Service • NA T S e r v i c e • SLA • Deployment Flow Engine • Di sc over y • W ork[...]

1-30 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center Security Requirements for MPLS VPNs • The Processing server can be added dynami cally . The W atchdog will discov er their e xistence when you start up ISC. • Each Collection server is responsible for a set of collection[...]

1-31 Cisco IP Solution Center, 3.0: MPLS VPN Ma nagement User Guide, 3.0 OL-4344-01 Chapter 1 About Cisco IP Solution Center The Four-Tier System Architecture Figur e 1 -12 Redundant Load Balancing Configur ation The Four-Tier System Architecture The Cisco ISC architecture is a four-t ier architecture. The four tiers are: • Client tier The Client[...]

1-32 Cisco IP Solution Center, 3.0: MPLS VPN Manage ment User Guide, 3.0 OL-4344-01 Chapter 1 Ab out Cisco IP Solution Center The Four-Tier System Architectu re • Contr o l tier The Control T ier consists of the ISC Repository (a relational database) and the task scheduling and distrib ution system. In ISC, th ere is only one Co ntrol tier machin[...]