- One of the very popular services
that are provided by a WAN provider is MPLS,
which is Multiprotocol Label Switching.
And at the CCNE level,
they want you to have a real high understanding of MPLS
and some of the terminology that goes along with it.
So let's talk about that.
So, with traditional routing,
a packet, a Layer 3 packet will come into a router.
And that router will strip off the Layer 2 header.
It might come in with an ethernet header or a PPP header.
The router will strip off that Layer 2 header,
and then right behind it
will be the Layer 3 header.
And then we'll look at the destination Layer 3 address,
like an IP version four, or an IP version six address.
And then that router will go into some table
like a routing table.
Or if that router is running Cisco Express Forwarding,
a copy of the routing table,
sort of the essential elements from the routing table
will be placed into a CEF table.
But either way, the router will look
for some sort of match of that destination IP address,
and then create a new Layer 2 header,
and forward the packet on out.
With MPLS, which stands for Multiprotocol Label Switching,
and I want you to pay attention
to those last two letters, label switching.
MPLS actually does something different.
So when a frame comes in,
a router in the WAN network,
so your service provider's router,
will actually take that Layer 2 header,
and right behind it, just before the Layer 3 header,
it will insert a new field called an MPLS Label,
called a label.
This might sound kinda familiar to you.
Once again, drawing an analogy to switching,
which hopefully you've already studied up to this point.
We know that in the world of switching,
when ethernet frame is going across an 802.1q trunk,
same type of thing happens.
When that frame gets to the switch.
The switch takes input in 802.1q tag,
after the source MAC address,
but before the Layer 3 packet.
It inserts that tag there.
So the same type of thing is happening here,
except instead of a .1q tag being applied,
applying something else called an MPLS label.
And then that label is actually what's used
by all these routers to forward the packet.
And actually, the reason why it's called
Multiprotocol Label Switching
is because MPLS can apply that label
to lots of different things.
We typically think of MPLS as being used
against IP packets, like IP version four
or IP version six.
But MPLS can actually be used
against a wide variety of things,
not even necessarily Layer 3 packets.
That's why its called multiprotocol.
The key idea though is that the routers
in the service provider's cloud,
when they're trying to figure out where does thing go,
they're no longer looking at a Layer 3 header
to answer that question.
They're now looking at this label.
They have a table of labels that says,
if I see this label, I'm gonna send it out this interface.
So it's label switching.
So this here shows an example of
what that label looks like.
So the label is a 32-bit field,
which should hopefully be easy to remember,
because IP version four addresses are 32-bits.
MPLS labels are 32-bits.
And you can see here a breakdown of that label.
Now I'm gonna come back to this in just one second.
I just wanna flash forward here for a second,
and just to give you an idea of where this label goes.
So here is our regular frame, right,
with our Layer 2 header, frame relay,
PPP, ethernet, whatever it is,
followed by our IP Header.
Well in the world of MPLS, we've got a Frame Header
and then the label is placed right here.
So that's where the label goes.
And sometimes you'll hear this called as a Shim Header.
But that's where the label goes.
So now let's go back to the previous slide
and take a look at what does this label look like
if we break it down, what components are in that label?
Okay so here I the label in its entirety.
So most of the label, so 20 bits of it,
20 bits out of the 32, are the label value.
So you can see there's actually quite a few numbers
you can come up with with a 20-bit field.
Then after that, we have a three-bit field,
which is called the experimental field.
So one of the things that MPLS service providers
can offer is something called quality of service.
And this experimental field is what allows them to do that.
So you can send packets into the service provider's network,
maybe some of those packets carry data,
maybe some of those packets carry voice,
and by modifying or changing the bits here
in the experimental field of the label
the voice packets can be differentiated
and identified differently from the data packets,
so they can get better service,
they can take faster paths, paths with less latency,
that's because of the experimental field right here,
which carries our quality of service markings.
And there's a bit here called
the bottom-of-the-stack indicator,
bottom-of-the-stack indicator.
And the reason why that's there
is because in a lot of MPLS offerings,
and I'm gonna talk briefly about MPLS VPNs, as an example,
you might see a situation in which there's
two or more labels applied to something.
Two or sometimes even three labels.
And so, an MPLS device, and MPLS router,
only looks at the top label, what's the top label?
The layer that's right next to Layer 2 header.
So if I go forward for a moment.
So for example, right here, here we have an example
of a frame that has three labels inside of it.
So we can see that the label that's
right after the Layer 2 header,
that's what we consider the top label.
And that's the label that an MPLS router will look at
to determine where do I send this thing,
what's the egress interface where I send
this data structure is the top label.
But then there can be--and that's called the top.
Then there can be labels after that,
and then the very last label, the very last one
is what we call the bottom label.
And the bottom label has that one little bit set,
that bottom-of-the-stack bit set to a one.
Why is that important?
Because, when a router receives
an incoming MPLS labeled structure,
and it sees that label there,
and it sees that the bottom-of-the-stack bit is set to one,
that router knows, aha, okay I need to pop that label off
and revert this thing back to looking like
a normal IP packet without any label at all.
So that bottom-of-the-stack bit indicates
that this is the very last label
and behind it you're going to see
your regular Layer 3 header.
So that's what that bottom-of-the-stack bit is used for.
So let me go back.
And then also we have at the very end, we have a TTL field.
So just like an IP packet has a time to live field,
an MPLS label has a time to live field.
Typically speaking, when an IP packet comes
into an MPLS router, the router will take a look
at the TTL field in the IP packet
and it will take whatever that number is
18, 64, 3, and it will copy it
into the TTL field, right here.
And now as each router gets this,
as each label router gets it and switches it based on labels
just like we would normally take a TTL
in an IP packet and decrement it by one,
well our label switching routers will also
decrement the TTL value here in the label itself by one.
Same rules apply.
Okay so I think we've seen everything on here.
There's nothing--we already talked
about where the label's applied.
And this is just showing you
that it's right after the Layer 2 header.
And sometimes you'll see that MPLS is called
a Layer 2.5 protocol.
In other words when talking about the OSI model,
and people are all, "Well where does this reside?
"Does it reside at the data link layer,
"at the network layer."
They say it's a Layer 2.5 protocol
because it's inserting the label
between the Layer 2 header and the Layer 3 header.
So they say it's a Layer 2.5 protocol,
so you might hear that term.
And so we've already talked about this,
and just this grouping of labels goes
by the term Label Stack, a Label Stack.
So you could have one or more labels in your label stack.
And just remember the key term of the top label,
that's the one right next to the Layer 2 header,
and the bottom label, which is the one right next
to the Layer 3 header.
Of course, if you've only got one label
they're both the same, the top and the bottom
are exactly the same 'cause you've only got one label.
And some terminology that we need to know for MPLS.
So a router that has the capability of looking at a label,
something that comes in that already has a label on it,
and saying okay based on this label value,
not the routing table, but my label table,
I'm gonna be able to figure out
which interface I need to forward this packet on,
or forward this thing on.
We technically call that a Label Switch Router.
And Label Switch Routers fall into sort of three categories,
Ingress Label Switch Router,
Intermediate Label Switch Router,
and Egress Label Switch Router.
So let me show you an example, a picture of this.
So take a look at this as an example.
So let's say that each of these boxes right here
represents a customer site.
And so this router here,
the brown routers, these belong to the customer.
So these are the customer routers
and these routers are at the edge of the customer's network.
In other words, these are at the edge of the network
that connect to the ISP.
So from an MPLS terminology,
these routers are called customer edge routers,
or CE routers.
And yes, you will want to be familiar with this terminology.
Customer edge routers.
Now all the routers here in the MPLS provider's network
are called label switching routers,
every single one of them,
because they either have the ability of taking in
a regular IP packet and slapping a new label on top of it
that did not exist before,
they have the capability of taking in a labeled packet,
looking at that label and figuring out
which egress interface to switch it out of,
or if it's on the other edge,
it has the ability of taking the label,
stripping it off completely,
revealing just a regular IP packet and then sending it out.
So, if we're talking about Customer A, here,
Customer A Site One
and Customer A Site Two,
in terminology we have the customer edge router,
so let's say that our packet comes in this way,
I'll just say P for packet.
And it gets right here.
So this here would be called an ingress label edge router.
Because it's ingress, it's receiving the ingress packet
and it's on the edge of the labeling network,
the label edge router.
So now this router here would take that packet
and it would apply a label to it,
like we just took a look at.
And then as it went into here,
these routers in the middle would
just be called intermediate,
let's see if I can put that right here.
Intermediate...
Label switching routers.
So an intermediate label switching router
all it does is it receives something
that already has a label on it
and then just switches it through based on that label.
Now once it gets to this guy right here,
so here it comes in, it's got a label.
We also have the packet behind it, so it comes in.
So this guy here is gonna take that label,
he's gonna recognize it, okay this is the last label,
there's no other label left,
he's gonna strip it off and he's gonna reveal the packet
and send the packet as it is, out.
So he will be called an egress...
Label edge router.
So all of these are label switching routers,
all of them are LSRs because they have the capability
of processing and understanding labels.
And a label edge router, like it sounds is at the edge
of the MPLS provider's network.
And ingress or egress just refers
to the direction of the traffic,
is the traffic coming in
or is it leaving the provider's network.
So you should be familiar with those.
Now a lot of times also you'll see in
a lot of books and documents
that in addition to the routers here on the edge
being called label edge routers,
there's another term for those you'll see,
which is called provider edge routers.
Because router one and router two,
they're owned by the service provider.
And just like A One and A Two are owned by the customer
but they are at the edge of the customer's network,
these two routers here, one and two,
well they're owned by the provider
and they are edge of the provider's network.
So we have customer edge routers
which connect to provider edge routers.
So CEs connect to PEs.
Now there's a couple of additional things
about this I want to talk about,
one of the--you might be wondering,
okay, well but really what's the benefit of this.
I mean so we're slapping on this new field called a label
and all of these label switching routers are figuring out
where to forward this thing based on a label
instead of based on IP header.
Why do we want to do that?
Where is the benefit of that?
A big reason why people like MPLS services is
because they can get something called MPLS VPNs.
Which stands for Virtual Private Network.
Well, what makes it private?
Here's one of the great things about MPLS VPNs.
I could have Customer A, and maybe Customer A
is using the 10.10 network,
so we've got all sorts of subnets of 10.10 over here
and all sorts of subnets of 10.20 over here.
Now you might be saying,
"But Keith, that's a private address,
"that's not a publicly routeable address."
Actually that's okay.
In this particular example the customer's not using
the MPLS VPN to access the internet.
All this WAN provider's doing is giving them access
so that One's customer site can talk
to another customer site.
It's not for internet access.
It's just for connecting one campus or branch to another.
And then guess what, down here in Customer B,
we could be using the exact same addresses, 10.20.0.0/16.
And the MPLS VPN allows us to have
overlapping address space like this
and it allows the packets to be kept separate.
In other words, Customer A does not have to worry
that his or her packets will ever show up
in Customer B's network.
The MPLS VPN makes sure that customer's packets
are always separate, isolated, they don't go
where they're not supposed to go
and from the provider's perspective it's great
because they can reuse IP addresses on different customers.
Now you might be thinking, well how is that possible,
how does that even work?
Well, without going into too many great details about this,
here's a high-level overview of this.
Up until now when we've been talking about routing,
you had this idea that a router
has one single IP routing table.
Let's just focus on IP version four for now.
It's got one IP version four routing table
and EIGRP or OSPF routes or RIP routes can feed into that,
but ultimately, when a packet comes into a router
it's that one table the router looks at,
we call that the global routing table,
to figure out, what do I do with this packet,
where do I forward it?
Well when we're dealing with MPLS VPNs,
the router still has a global routing table,
so now what we're gonna focus on is
just the provider's networks,
so the customers don't do MPLS at all.
In an MPLS VPN, or even if you're not doing VPN,
the customer routers, the CE routers,
now let me just put that on here,
they have no knowledge of MPLS.
They're not doing any kind of labeling,
they're just sending and receiving
to the provider just regular IP packets
packaged in ethernet frames or PPP frames
or whatever they choose to use
to connect to the provider.
So it's all the provider's equipment in here
that's doing all the labeling and the swapping
and doing all this MPLS VPN stuff I'm about to describe.
So this provider's network,
now this provider's network is probably also used
for them for internal stuff.
For example, they've got their own email system
for their own employees,
they have their own internal websites
for like their payroll, their human resources,
and marketing and stuff,
so it may actually be that this network here
is not only being used to transport packets
from one customer site to another,
it's actually being used also internally
by the service provider itself
as their own enterprise network for themselves.
So there's gonna be some routing protocol running here
within these routers.
It could be anything, whatever, whatever they want to use.
Let's just say, let's just say it's doing OSPF,
although it could be EIGRP, it could be RIP,
it could be anything.
So all of these routers learn about each other
and they're able to reach each other via
whatever interior gateway protocol the service provider's
running for themselves, within their own network right here.
Okay, so now, in addition to that,
so all of that, all of those routes that are being learned,
are being learned in the global routing tables.
And let's just put some terminology back on here
that I mentioned earlier.
So we'll just say this is PE1
and this is provider edge two, PE2.
Okay so, for example, PE1 if you did a show ip route command
and looked at his global routing table
he would know how to reach 3.3.3.3, 4.4.4.4,
and all these other routers in the middle.
But here's what makes an MPLS VPN so powerful,
able to separate customer routes, keep them separate,
even to the extent that one customer
can be using the exact same subnets as another customer.
Which is the fact that on these PE routers,
in addition to the global routing table,
each interface that connects to a customer
is in it's own separate routing table.
It's like these little private routing tables.
We actually call these VRFs,
Virtual Routing and Forwarding instances, VRFs, a VRF.
So right now, as I've drawn it,
if we just focus in right now on provider edge one,
he actually has three routing tables he's keeping track of,
he's got the global routing table,
for all the routes he's learned about
about his own internal network,
and he's got a separate private VRF routing table
for Customer A,
and another VRF for Customer B.
So right there that's one thing
that keeps the route separate
because the 10.10 network that's learned,
and by the way between the CE and PE,
there's going to be some routing protocol running.
Let's just put that right here.
And once again that's completely between the customer
and between the provider.
So for example, Customer B, they might choose to run EIGRP
between their customer edge router
and the provider edge router.
And Customer A, might choose to run RIP
between their customer edge routers
and the provider edge router.
So there's some sort of routing going on here
so that the customer can say, "Hey service provider,
"here's all the routes I'm using in my network.
"Here they are."
So you can see that the customer edge router
is forming a neighborship, if it's EIGRP or OSPF,
with the service provider,
with the service provider's PE router
there's a neighborship being formed.
Okay so that's one thing.
So that's how we keep the routes separate,
is because these interfaces are actually assigned
to their own private routing tables called VRFs.
And then in order to actually complete the MPLS VPN
to keep the route separate,
there is actually from these PE routers right here
they are talking to each other via
the border gateway protocol, via BGP.
So I'm not gonna go into much more detail than this,
this is actually already going into more detail
than the CCNA books go into that I've looked at.
But the main takeaway that I wanted you to have
is that an MPLS VPN has several benefits.
Number one, the customer's routes
will be kept separate from any other customer's routes.
By having this combination
of virtual routing and forwarding tables,
by doing routing with the provider,
and by having BGP running in the provider's network,
the combination of all that, along with labels,
labels play a factor in this,
labels play a very important factor,
is what helps keep the customers' traffic separate.
So Customer A's traffic will never show up
in Customer B's network.
Also this MPLS VPN is a very good thing
from the provider's point of view
because it helps them to conserve IP addresses.
They can provide the same subnets
to totally different customers,
overlapping subnets of the MPLS VPN,
this combination of BGP and labeling and VRFs.
The combination of all this stuff working together
helps these overlapping subnets stay separate.
In other words the service provider can know
okay, this 10.10 network down here belongs to Customer B,
there's some coupling that takes place with MPLS labels,
this label along with this network
means this belongs to Customer B.
This other label, completely different number,
with the same network, belongs to Customer A.
And that's how an MPLS VPN is pieced together
and provides this security.
And one last thing I want to mention before I leave this.
A lot of times when people think of virtual private networks
the first thing that comes to their minds is,
oh, we're talking encryption, we're talking security.
MPLS VPNs, by themselves,
have nothing to do with encryption.
The privacy in an MPLS VPN is just the fact that
you know that your traffic, Customer A,
is only going to stay between your Customer A sites.
You don't have to worry about your traffic
ever going to another customer's sites.
That's where you get the privacy.
Now you certainly can run some sort of encryption
on top of MPLS VPNs to add an even, added layer of security
to encrypt your traffic.
But an MPLS VPN just by itself and how it works
has nothing to do with encryption,
it will not do encryption.
So that concludes this section on an overview of MPLS.