CloudLabBox
Try the free demo

MPLS and L3VPN lab 10 of 11

Troubleshooting the VPN layer across three vendors

A contractor has broken a customer's VPN on IOS, Junos and RouterOS PEs at once, while the label core stays healthy. Use a five-stage method to find four faults in sessions, route targets, extended communities and export policy, and restore all three sites.

Run this lab

It needs Standard: its 7 nodes are set to 10 vCPU and 7,936 MB in total.

In your workspace: Shared, then MPLS and L3VPN guided labs, then 10 - Troubleshooting the VPN layer across three vendors

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 10 vCPU and 7,936 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
10 vCPU, 7,936 MB
Smallest plan
Standard

The scenario

It's Monday morning. Over the weekend a contractor "tidied up" the configuration on all three of Wrenfield's PEs, and now Alder Foods' sites can't reach each other. The LDP core wasn't touched, and the contractor's change notes are, in his words, "somewhere". The customers' routers weren't touched either: only the three PEs are at fault, and all the faults are in the VPN layer.

Your ticket: all three Alder sites must reach each other, sourced from their LANs. You'll find four separate faults. Fix one, and the next will come into view. Correct the fault, don't work around it: keep the RDs and the route target as designed.

SiteCEPELANDesign
1CE1 (AS 65201)PE1, IOS, 10.255.0.1192.168.1.0/24VRF ALDER, RD 65100:1
2CE2 (AS 65202)PE2, Junos, 10.255.0.3192.168.2.0/24VRF ALDER, RD 65100:3
3CE3 (AS 65203)PE3, RouterOS, 10.255.0.4192.168.3.0/24VRF ALDER, RD 65100:4

All sites use route target 65100:100, and PEs peer in a full mesh of VPNv4 sessions.

DeviceInterfaceAddressConnects to
CE1Loopback1192.168.1.1/24
CE1Gi0/0172.16.1.2/30PE1 Gi0/0
PE1Loopback010.255.0.1/32
PE1Gi0/0172.16.1.1/30CE1 Gi0/0
PE1Gi0/110.0.12.1/30P Gi0/0
PLoopback010.255.0.2/32
PGi0/010.0.12.2/30PE1 Gi0/1
PGi0/110.0.23.1/30PE2 ge-0/0/0
PGi0/210.0.24.1/30PE3 ether1
PE2ge-0/0/010.0.23.2/30P Gi0/1
PE2ge-0/0/1172.16.2.1/30CE2 Gi0/0
PE2lo010.255.0.3/32, 127.0.0.1/32
CE2Loopback1192.168.2.1/24
CE2Gi0/0172.16.2.2/30PE2 ge-0/0/1
PE3loopback10.255.0.4/32
PE3ether110.0.24.2/30P Gi0/2
PE3ether2172.16.3.1/30CE3 Gi0/0
CE3Loopback1192.168.3.1/24
CE3Gi0/0172.16.3.2/30PE3 ether2

What you’ll practise

  • Walk a missing route through five stages, from session to label stack
  • Read the same stage on IOS, Junos and RouterOS
  • Spot a route that a PE dropped because no VRF imports it
  • Fix address-family, route-target and export faults without changing the design

The tasks

  • A method for the VPN layer

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Troubleshooting the VPN layer across three vendors7 nodes, 6 links. Every link is listed as text below the diagram.CE1PE1PPE2CE2PE3CE3Gi0/0Gi0/0Gi0/1Gi0/0ge-0/0/1Gi0/0ether2Gi0/0Gi0/1ge-0/0/0Gi0/2ether1
7 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • CE1 Gi0/0 to PE1 Gi0/0
  • PE1 Gi0/1 to P Gi0/0
  • P Gi0/1 to PE2 ge-0/0/0
  • P Gi0/2 to PE3 ether1
  • PE2 ge-0/0/1 to CE2 Gi0/0
  • PE3 ether2 to CE3 Gi0/0
Nodes in Troubleshooting the VPN layer across three vendors, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
CE1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PE1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PE2Juniper vJunos-routervjunosrouter-24.2R1-S2.54 vCPU, 5,120 MB
CE2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PE3MikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
CE3Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MPLS and L3VPN guided labs.

  3. Open 10 - Troubleshooting the VPN layer across three vendors and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MPLS and L3VPN labs

All MPLS and L3VPN labs

Related labs in other courses

CloudLabBox is independent of Cisco, Juniper Networks and MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.