CloudLabBox
Try the free demo

CCNP Service Provider lab 22 of 23

Troubleshooting: BGP and L3VPN

Fix a newly built VPN that has never worked. Follow one route from CE to CE, and find five faults across iBGP, route reflection, route targets and PE-CE policy.

Run this lab

It needs Standard: its 5 nodes are set to 5 vCPU and 8,704 MB in total.

In your workspace: Shared, then CCNP Service Provider guided labs, then 22 - Troubleshooting - BGP and L3VPN

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 5 vCPU and 8,704 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 60 minutes
Nodes need
5 vCPU, 8,704 MB
Smallest plan
Standard

The scenario

Maple Foods has a new VPN from Fellgate Carrier, and it has never worked. The provisioning team built it from a template and swears nothing is wrong. The ticket says:

Ticket 4502. Maple Foods, sites 1 and 2 can't reach each other. CE1 and CE2 have no routes from the provider. VPN was turned up today.

The intended design:

  • PE1 and PE2 are route-reflector clients of RR, with VPNv4 sessions between loopbacks.
  • VRF MAPLE imports and exports 64500:100.
  • Both CEs are in AS 65001, so the PEs use as-override.
  • Each eBGP session has a PASS policy both ways.

IS-IS and LDP are fine, so you can trust the label path. There are five faults, all in BGP and the VPN.

DeviceInterfaceAddressConnects to
CE1Loopback1192.168.1.1/24
CE1Gi0/0172.16.1.2/30PE1 Gi0/0/0/2
PE1Loopback010.255.0.1/32
PE1Gi0/0/0/010.0.12.1/30RR Gi0/0/0/0
PE1Gi0/0/0/2172.16.1.1/30CE1 Gi0/0
RRLoopback010.255.0.2/32
RRGi0/0/0/010.0.12.2/30PE1 Gi0/0/0/0
RRGi0/0/0/110.0.23.1/30PE2 Gi0/0/0/0
PE2Loopback010.255.0.3/32
PE2Gi0/0/0/010.0.23.2/30RR Gi0/0/0/1
PE2Gi0/0/0/2172.16.2.1/30CE2 Gi0/0
CE2Loopback1192.168.2.1/24
CE2Gi0/0172.16.2.2/30PE2 Gi0/0/0/2

What you’ll practise

  • Follow a VPN route through each table
  • Fix an iBGP session between loopbacks
  • Find a missing route-reflector client
  • Compare route targets and repair an import
  • Fix PE-CE policy and the AS-path loop check

The tasks

  1. A method for VPN faults
  2. The iBGP layer
  3. The VPN layer
  4. The PE-CE layer
  5. Prove the service

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Troubleshooting - BGP and L3VPN5 nodes, 4 links. Every link is listed as text below the diagram.CE1PE1RRPE2CE2Gi0/0Gi0/0/0/2Gi0/0/0/0Gi0/0/0/0Gi0/0/0/1Gi0/0/0/0Gi0/0/0/2Gi0/0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • CE1 Gi0/0 to PE1 Gi0/0/0/2
  • PE1 Gi0/0/0/0 to RR Gi0/0/0/0
  • RR Gi0/0/0/1 to PE2 Gi0/0/0/0
  • PE2 Gi0/0/0/2 to CE2 Gi0/0
Nodes in Troubleshooting: BGP and L3VPN, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
CE1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PE1Cisco IOS XRvxrv-k9-demo-6.3.11 vCPU, 2,560 MB
RRCisco IOS XRvxrv-k9-demo-6.3.11 vCPU, 2,560 MB
PE2Cisco IOS XRvxrv-k9-demo-6.3.11 vCPU, 2,560 MB
CE2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP Service Provider guided labs.

  3. Open 22 - Troubleshooting - BGP and L3VPN and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP Service Provider labs

All CCNP Service Provider labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.