CloudLabBox
Try the free demo

CCIE Enterprise Infrastructure practice lab 5 of 8

MPLS L3VPN and VRF services

Build a dual-stack enterprise MPLS WAN for two merged business units with overlapping addresses: LDP tuned to host routes, a VPNv4 and VPNv6 route reflector pair, PE-CE routing in BGP, OSPF, EIGRP and static, an extranet with selective route leaking, and Internet access through VRF-aware NAT and a VASI pair. A 3 to 4 hour practice lab.

Run this lab

It needs Standard: its 12 nodes are set to 12 vCPU and 9,728 MB in total.

In your workspace: Shared, then CCIE Enterprise Infrastructure practice guided labs, then 05 - MPLS L3VPN and VRF services

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 12 vCPU and 9,728 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 240 minutes
Nodes need
12 vCPU, 9,728 MB
Smallest plan
Standard

The scenario

Halden Freight now owns its MPLS WAN. Two business units share it, and they use the same private addresses, because Finance came from another company. A third VRF holds shared services, and a CSR 1000v called GW is the only way to the Internet.

   L1 ----- PE1 --- P1 --- PE2 ----- L2   (LOG, AS 65001, dual homed)
   F1 -----  |   \  |   /  |  \_____ GW ---- INET  (Internet)
             |    \ |  /   |   VLANs 10, 20
             |     P2      |
             |   /         |
             +--/---- PE3 -+-- L2 (second link)
                       |  \
                      F2   SV (shared services)
VRFRD (PE1, PE2, PE3)Route targetsPE-CE routing
LOG65000:101, 102, 10365000:10 both ways; imports 65000:50eBGP: L1 and L2 are both AS 65001. GW is AS 65005.
FIN65000:201, 202, 20365000:20 both ways; imports 65000:50OSPF with F1, EIGRP AS 100 with F2. GW is AS 65005 by eBGP.
SVC65000:503 on PE3Exports 65000:50, imports 65000:999Static to SV
WhatDesign
CoreAS 65000. OSPF area 0 runs in the start-up configuration. P1 and P2 are VPN route reflectors in cluster 10.255.5.254.
LOG LANsL1 10.10.1.0/24 and server LAN 10.11.1.0/24; L2 10.10.2.0/24
FIN LANsF1 10.10.1.0/24 and server LAN 10.12.1.0/24; F2 10.10.2.0/24
SVC LANSV 10.50.1.0/24
L2PE2 is its primary PE in both directions, and PE3 the backup
InternetINET is 198.18.0.1. LOG reaches it through a VASI pair on GW (vasileft1 198.51.100.1/30 in VRF LOG, vasiright1 198.51.100.2/30 in the global table). FIN reaches it directly through Gi2. INET knows only 198.51.100.0/30 and 203.0.113.0/30.
IPv6LOG only: LANs 2001:db8:5:1::/64 and 2001:db8:5:2::/64, over the IPv4 core

Addressing

DeviceInterfaceAddressConnects to
P1Lo010.255.5.1/32
P1Gi0/010.5.12.1/30P2 Gi0/0
P1Gi0/110.5.101.2/30PE1 Gi0/0
P1Gi0/210.5.201.2/30PE2 Gi0/0
P1Gi0/310.5.31.2/30PE3 Gi0/0
P2Lo010.255.5.2/32
P2Gi0/010.5.12.2/30P1 Gi0/0
P2Gi0/110.5.102.2/30PE1 Gi0/1
P2Gi0/210.5.202.2/30PE2 Gi0/1
P2Gi0/310.5.32.2/30PE3 Gi0/1
PE1Lo010.255.5.21/32
PE1Gi0/010.5.101.1/30P1 Gi0/1
PE1Gi0/110.5.102.1/30P2 Gi0/1
PE1Gi0/2172.16.11.1/30, 2001:db8:5:11::1/64L1 Gi0/0
PE1Gi0/3172.16.21.1/30F1 Gi0/0
PE2Lo010.255.5.22/32
PE2Gi0/010.5.201.1/30P1 Gi0/2
PE2Gi0/110.5.202.1/30P2 Gi0/2
PE2Gi0/2172.16.12.1/30, 2001:db8:5:12::1/64L2 Gi0/0
PE3Lo010.255.5.23/32
PE3Gi0/010.5.31.1/30P1 Gi0/3
PE3Gi0/110.5.32.1/30P2 Gi0/3
PE3Gi0/2172.16.13.1/30, 2001:db8:5:13::1/64L2 Gi0/1
PE3Gi0/3172.16.23.1/30F2 Gi0/0
PE3Gi0/4172.16.50.1/30SV Gi0/0
L1Lo010.255.5.11/32
L1Lo1010.10.1.1/24, 2001:db8:5:1::1/64
L1Lo1110.11.1.1/24
L1Gi0/0172.16.11.2/30, 2001:db8:5:11::2/64PE1 Gi0/2
L2Lo010.255.5.13/32
L2Lo1010.10.2.1/24, 2001:db8:5:2::1/64
L2Gi0/0172.16.12.2/30, 2001:db8:5:12::2/64PE2 Gi0/2
L2Gi0/1172.16.13.2/30, 2001:db8:5:13::2/64PE3 Gi0/2
F1Lo010.255.5.12/32
F1Lo1010.10.1.1/24
F1Lo1110.12.1.1/24
F1Gi0/0172.16.21.2/30PE1 Gi0/3
F2Lo010.255.5.14/32
F2Lo1010.10.2.1/24
F2Gi0/0172.16.23.2/30PE3 Gi0/3
SVLo1010.50.1.1/24
SVGi0/0172.16.50.2/30PE3 Gi0/4
GWLo010.255.5.30/32
GWGi2203.0.113.2/30INET Gi0/0
INETLo10198.18.0.1/24
INETGi0/0203.0.113.1/30GW Gi2

Rules for the whole lab

  • Keep every address as given. When an interface moves into a VRF, give it the same address again.
  • INET and SV are outside your control. P routers carry no customer routes in their routing tables.
  • No static routes except those the design names, and no route leaking through the global table except where the design names it.
  • Don't remove the LAB-FAIL-* applets.

What you’ll practise

  • Build an MPLS core with LDP limits and IGP synchronisation, and prove LSPs with MPLS ping and traceroute
  • Run L3VPN with BGP, OSPF, EIGRP and static PE-CE routing in one design
  • Solve a dual-homed site with as-override and site of origin
  • Build an extranet with route targets and export maps
  • Give overlapping VRFs Internet access through VRF-aware NAT and a VASI pair
  • Carry IPv6 over an IPv4 MPLS core with 6VPE

The tasks

  • Section 1: The MPLS core (16 points)
  • Section 2: L3VPN with four PE-CE protocols (30 points)
  • Section 3: Extranet with selective leaking (16 points)
  • Section 4: Internet through GW (20 points)
  • Section 5: 6VPE and the failure drill (18 points)

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of MPLS L3VPN and VRF services12 nodes, 15 links. Every link is listed as text below the diagram.P1P2PE1PE2PE3L1L2F1F2SVGWINETGi0/3Gi0/0Gi2Gi0/0Gi0/2Gi0/0Gi0/3Gi0/0Gi0/3Gi1Gi0/4Gi0/0Gi0/0Gi0/0Gi0/2Gi0/0Gi0/3Gi0/1Gi0/1Gi0/0Gi0/1Gi0/1Gi0/2Gi0/0Gi0/2Gi0/1Gi0/2Gi0/1Gi0/3Gi0/0
12 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • P1 Gi0/0 to P2 Gi0/0
  • P1 Gi0/1 to PE1 Gi0/0
  • P2 Gi0/1 to PE1 Gi0/1
  • P1 Gi0/2 to PE2 Gi0/0
  • P2 Gi0/2 to PE2 Gi0/1
  • P1 Gi0/3 to PE3 Gi0/0
  • P2 Gi0/3 to PE3 Gi0/1
  • PE1 Gi0/2 to L1 Gi0/0
  • PE1 Gi0/3 to F1 Gi0/0
  • PE2 Gi0/2 to L2 Gi0/0
  • PE3 Gi0/2 to L2 Gi0/1
  • PE3 Gi0/3 to F2 Gi0/0
  • PE3 Gi0/4 to SV Gi0/0
  • PE2 Gi0/3 to GW Gi1
  • GW Gi2 to INET Gi0/0
Nodes in MPLS L3VPN and VRF services, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
P1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
P2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PE1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PE2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PE3Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
L1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
L2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
F1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
F2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SVCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
GWCisco CSR 1000vcsr1000vng-universalk9.17.03.08a-serial1 vCPU, 4,096 MB
INETCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCIE Enterprise Infrastructure practice guided labs.

  3. Open 05 - MPLS L3VPN and VRF services and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCIE Enterprise Infrastructure practice labs

All CCIE Enterprise Infrastructure practice labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.