CCRG-4-1-2 (1)

VRF Selection • On the MPLS PE router two VRF instances are configured. One for Client 1 or A (VRF CEA) and one for Client 2 or B (VRF CEB) • On MPLS PE, any communication from the Client A network (172.16.1.0) will be assigned to VRF CEA. Any communication from the Client B network (172.16.2.0) will be assigned to VRF CEB.>>PE<<ip vrf CEArd 50:500route-target export 50:500route-target import 50:500access-list 1 permit 172.16.1.0 0.0.255.255route-map ROUTEHUB-PBR-VS permit 10match ip address 1set vrf CEAip route vrf Client1 172.16.1.0 255.255.255.0 192.168.10.2ip vrf CEBrd 60:600route-target export 60:600route-target import 60:600access-list 2 permit 172.16.2.0 0.0.255.255route-map ROUTEHUB-PBR-VS permit 20match ip address 2set vrf CEBip route vrf Client2 172.16.2.0 255.255.255.0 192.168.10.3interface FastEthernet0/0ip vrf receive CEAip vrf receive CEBip address 192.168.10.1 255.255.255.0ip policy route-map ROUTEHUB-PBR-VS Configuration Reference Guide | [M] 326

Solution/Services: Tunneling: L3VPNRelated: N/AAccess Configuration (No VRF) • Access Switch configured for two client networks. Client1 will exist in VLAN 100 amd Client2 will exist in VLAN 200. • VLANs extended across 802.1Q connection to the Aggregation switchvlan 100name VLAN-CL1vlan 200name VLAN-CL2interface FastEthernet0/1description TO: LAN Distributionswitchport trunk allowed vlan 100,200switchport mode trunkswitchport nonegotiatecarrier-delay msec 0interface FastEthernet0/2description HOST: Client 1switchport access vlan 100switchport mode accessspanning-tree portfastspanning-tree bpdufilter enablespanning-tree bpduguard enable Configuration Reference Guide | [M] 327

interface FastEthernet0/3description HOST: Client 2switchport access vlan 200switchport mode accessspanning-tree portfastspanning-tree bpdufilter enablespanning-tree bpduguard enableDistribution/Aggregation Configuration (VRF) • VRF enabled • A separate routing table of learned routes will exist for Client1 network and Client2 network. They are not shared in the global routing table. • Client 1 will exist in VLAN 100. All routing within Client 1 network will be isolated in VRF CL1 configured for OSPF. The uplink/downlink to the Core for Client 1 traffic will exist in VLAN199. • Client 2 will exist in VLAN 200. All routing within Client 2 network will be isolated in VRF CL2 configured for OSPF. The uplink/downlink to the Core for Client 2 traffic will exist in VLAN299.vlan 100name VLAN-CL1vlan 199name VLAN-CL1-ICT1ip vrf CL1rd 10:100route-target export 10:100route-target import 10:100interface Vlan100description VLAN: Client 1 LANip vrf forwarding CL1ip address 10.1.100.1 255.255.255.0no ip redirectsno ip unreachablesno ip proxy-arpinterface Vlan199description VLAN: Client 1 ICT with Coreip vrf forwarding CL1ip address 10.1.99.2 255.255.255.252no ip redirectsno ip unreachablesno ip proxy-arprouter ospf 10 vrf CL1area 10 range 10.1.0.0 255.255.0.0network 10.1.99.0 0.0.0.3 area 0network 10.1.100.0 0.0.0.255 area 10 Configuration Reference Guide | [M] 328

vlan 200name VLAN-CL2vlan 299name VLAN-CL2-ICT1ip vrf CL2rd 10:200route-target export 10:200route-target import 10:200interface Vlan200description VLAN: Client 2 LANip vrf forwarding CL2ip address 10.2.200.1 255.255.255.0no ip redirectsno ip unreachablesno ip proxy-arpinterface Vlan299description VLAN: Client 2 ICT with Coreip vrf forwarding CL2ip address 10.2.99.2 255.255.255.252no ip redirectsno ip unreachablesno ip proxy-arprouter ospf 20 vrf CL2area 20 range 10.2.0.0 255.255.0.0network 10.2.99.0 0.0.0.3 area 0network 10.2.200.0 0.0.0.255 area 20interface GigabitEthernet0/1description TO: LAN Coreswitchport trunk encapsulation dot1qswitchport trunk allowed vlan 100,200,199,299switchport mode trunkswitchport nonegotiatecarrier-delay msec 0interface GigabitEthernet0/2description TO: LAN Accessswitchport trunk encapsulation dot1qswitchport trunk allowed vlan 100,200switchport mode trunkswitchport nonegotiatecarrier-delay msec 0 Configuration Reference Guide | [M] 329

Core Configuration (VRF) • VRF enabled • A separate routing table of learned routes will exist for Client1 network and Client2 network. They are not shared in the global routing table. • All routing within Client 1 network will be isolated in VRF CL1 configured for OSPF. The uplink to the Zone Router will exist in VLAN 198. The downlink to the Aggregation for Client 1 traffic will exist in VLAN199. • All routing within Client 2 network will be isolated in VRF CL2 configured for OSPF. The uplink to the Zone Router will exist in VLAN 298. The downlink to the Aggregation for Client 1 traffic will exist in VLAN299.vlan 198name VLAN-CL1-ICT2vlan 199name VLAN-CL1-ICT1ip vrf CL1rd 10:100route-target export 10:100route-target import 10:100interface Vlan198ip vrf forwarding CL1ip address 10.1.98.2 255.255.255.252no ip redirectsno ip unreachablesno ip proxy-arpinterface Vlan199ip vrf forwarding CL1ip address 10.1.99.1 255.255.255.252no ip redirectsno ip unreachablesno ip proxy-arprouter ospf 10 vrf CL1network 10.1.98.0 0.0.0.3 area 0network 10.1.99.0 0.0.0.3 area 0vlan 298name VLAN-CL2-ICT2vlan 299name VLAN-CL2-ICT1ip vrf CL2rd 10:200route-target export 10:200route-target import 10:200interface Vlan298ip vrf forwarding CL2ip address 10.2.98.2 255.255.255.252no ip redirectsno ip unreachablesno ip proxy-arp Configuration Reference Guide | [M] 330

interface Vlan299ip vrf forwarding CL2ip address 10.2.99.1 255.255.255.252no ip redirectsno ip unreachablesno ip proxy-arprouter ospf 20 vrf CL2network 10.2.98.0 0.0.0.3 area 0network 10.2.99.0 0.0.0.3 area 0interface GigabitEthernet0/1description TO: LAN Coreswitchport trunk encapsulation dot1qswitchport trunk allowed vlan 198,298switchport mode trunkswitchport nonegotiatecarrier-delay msec 0interface GigabitEthernet0/2description TO: LAN Accessswitchport trunk encapsulation dot1qswitchport trunk allowed vlan 199,299switchport mode trunkswitchport nonegotiatecarrier-delay msec 0 Configuration Reference Guide | [M] 331

Zone Configuration (No VRF) • No VRF configuration • Zone Router’s global routing table will contain both client network’s learned routes. • All routes learned via OSPF for Client1 will be redistributed into the OSPF domain for Client2. The downlink to the Core Router will exist in VLAN 198. • All routes learned via OSPF for Client2 will be redistributed into the OSPF domain for Client1. The downlink to the Core Router will exist in VLAN 298.ip access-list standard CL1-ACLpermit 10.1.0.0 0.0.255.255ip access-list standard CL2-ACLpermit 10.2.0.0 0.0.255.255vlan 198name VLAN-CL1-ICT2interface Vlan198ip address 10.1.98.1 255.255.255.252no ip redirectsno ip unreachablesno ip proxy-arprouter ospf 10redistribute ospf 20 subnetsdefault-information originate alwaysdistribute-list CL2-ACL out ospf 20vlan 298name VLAN-CL2-ICT2interface Vlan298ip address 10.2.98.1 255.255.255.252no ip redirectsno ip unreachablesno ip proxy-arprouter ospf 20redistribute ospf 10 subnetsnetwork 10.2.98.0 0.0.0.3 area 0default-information originate alwaysdistribute-list CL1-ACL out ospf 10interface GigabitEthernet0/1switchport trunk encapsulation dot1qswitchport trunk allowed vlan 198,298switchport mode trunkswitchport nonegotiatecarrier-delay msec 0 Configuration Reference Guide | [M] 332

Firewall Between Zone and Core • Two virtual firewalls defined for each client network using the tagged VLANs that are configured between the Core and the Zone router (Client1 is using VLAN198 and Client2 is using VLAN298)mode multiplefirewall transparentinterface gigabitethernet 0.198no shutdowninterface gigabitethernet 1.198no shutdowncontext CL1-FWallocate-interface gigabitethernet 0.198allocate-interface gigabitethernet 1.198configure disk0://CL1-FW.cfginterface gigabitethernet 0.298no shutdowninterface gigabitethernet 1.298no shutdowncontext CL2-FWallocate-interface gigabitethernet 0.298allocate-interface gigabitethernet 1.298configure disk0://CL2-FW.cfg • Firewall policy and configuration for Client1 networkcontext CL1-FWhostname CL1-FWdomain c1.routehub.localpasswd secret123enable password secret123interface gigabitethernet 0.198nameif outsidesecurity-level 0no shutdowninterface gigabitethernet 1.198nameif insidesecurity-level 100no shutdown Configuration Reference Guide | [M] 333

access-list CL1-ACL extended permit 89 any anyaccess-list CL1-ACL extended permit tcp any host 10.2.200.100 eq 8080access-list CL1-ACL extended permit tcp any host 10.2.200.101 eq 22access-list CL1-ACL extended permit tcp any host 10.2.200.102 eq 3389access-group CL1-ACL in interface outside • Firewall policy and configuration for Client2 networkcontext CL2-FWhostname CL2-FWdomain c2.routehub.localpasswd secret123enable password secret123interface gigabitethernet 0.298nameif outsidesecurity-level 0no shutdowninterface gigabitethernet 1.298nameif insidesecurity-level 100no shutdownaccess-list CL2-ACL extended permit 89 any anyaccess-list CL2-ACL extended permit tcp any host 10.1.100.100 eq 8080access-list CL2-ACL extended permit tcp any host 10.1.100.101 eq 22access-list CL2-ACL extended permit tcp any host 10.1.100.102 eq 3389access-group CL2-ACL in interface outside Configuration Reference Guide | [M] 334

Below reflects a practical deployment and configuration of IPv4 Multicast:CS01ip multicast-routinginterface Loopback0ip address 10.0.0.1 255.255.255.255ip pim sparse-modeinterface Loopback1ip address 10.0.0.254 255.255.255.255ip pim sparse-modeinterface GigabitEthernet2/1description TO: CS02ip address 10.1.2.1 255.255.255.0ip pim sparse-modeinterface GigabitEthernet2/2description TO: DS01ip address 10.1.3.1 255.255.255.0ip pim sparse-modeinterface GigabitEthernet2/3description TO: GR01ip address 10.1.4.1 255.255.255.0ip pim sparse-mode Configuration Reference Guide | [M] 335

! configure switch to discover multicast RPip pim autorp listener (or ip pim auto-rp listener)ip pim register-source Loopback0! advertise RP address with multicast groups that this switch is willing to serve as the candidate RP to the AutoRP mapping agents.access-list 10 permit 239.1.0.0 0.0.255.255ip pim send-rp-announce Loopback1 scope 32 group-list 10! configures AutoRP mapping agent which will listen for the RP and then advertise it to the rest of the network.ip pim send-rp-discovery Loopback0 scope 32! configure Multicast Source Discovery Protocol (MSDP) for RP redundancyip msdp peer 10.0.0.2 connect-source Loopback0ip msdp cache-sa-stateip msdp originator-id Loopback0CS02ip multicast-routinginterface Loopback0ip address 10.0.0.2 255.255.255.255ip pim sparse-modeinterface Loopback1ip address 10.0.0.254 255.255.255.255ip pim sparse-modeinterface GigabitEthernet2/1description TO: CS01ip address 10.1.2.2 255.255.255.0ip pim sparse-modeinterface GigabitEthernet2/2description TO: DS01ip address 10.2.3.2 255.255.255.0ip pim sparse-modeaccess-list 10 permit 239.1.0.0 0.0.255.255ip pim autorp listener (or ip pim auto-rp listener)ip pim register-source Loopback0ip pim send-rp-announce Loopback1 scope 32 group-list 10ip pim send-rp-discovery Loopback0 scope 32ip msdp peer 10.0.0.1 connect-source Loopback0ip msdp cache-sa-stateip msdp originator-id Loopback0 Configuration Reference Guide | [M] 336

DS01ip multicast-routingip pim autorp listenerip pim register-source Loopback0interface Loopback0ip address 10.0.0.5 255.255.255.255ip pim sparse-modeinterface GigabitEthernet2/1description TO: CS01ip address 10.1.3.3 255.255.255.0ip pim sparse-modeinterface GigabitEthernet3/1description TO: CS02ip address 10.2.3.3 255.255.255.0ip pim sparse-modeGR01ip multicast-routingip pim autorp listenerip pim register-source Loopback0interface Loopback0ip address 10.0.0.4 255.255.255.255ip pim sparse-modeinterface GigabitEthernet0/0description TO: WAN (RGR01)ip address 10.4.5.4 255.255.255.0ip pim sparse-modeinterface GigabitEthernet0/1description TO: CS01ip address 10.1.4.4 255.255.255.0ip pim sparse-mode Configuration Reference Guide | [M] 337

RGR01ip multicast-routingip pim autorp listenerip pim register-source Loopback0interface Loopback0ip address 10.0.0.5 255.255.255.255ip pim sparse-modeinterface GigabitEthernet0/0description TO: WAN (GR01)ip address 10.4.5.5 255.255.255.0ip pim sparse-modeinterface GigabitEthernet0/1description TO: LANip address 10.5.5.1 255.255.255.0ip pim sparse-mode Configuration Reference Guide | [M] 338

Solution/Services: MulticastRelated: PIMLayer 2 Switch Commandsshow ip igmp profileshow ip igmp snoopingshow igmp modeshow igmp querier informationshow igmp statshow cgmpshow mls multicastshow mls multicast entryshow mls multicast statisticsshow multicast group <mac-address>show multicast group countshow multicast protocols statusshow multicast routerLayer 3 Router/Switch Commandsshow ip mrouteshow ip mroute countshow ip mroute <multicast-address> countshow ip mroute activeshow ip mcacheshow ip mpcketshow ip pim interfaceshow ip pim neighborshow ip pim rpshow mls rp ip multicastshow ip rpfMSDP Commandsshow ip msdp countshow ip msdp peershow ip msdp sa-cacheshow ip mdp summaryOther Commandsshow ip igmp groupshow ip igmp interface vlan3show igmp groupinfo <vlan> <mac-address>show cam static <vlan>show ip igmp groupshow mls ip multicast group <multicast-address> Configuration Reference Guide | [M] 339

Solution/Services: MulticastRelated: PIMStatic RP • Multicast Routing: PIM Sparse Mode • Static RP pointing to RP router (1.1.1.1)>> RP ROUTER <<ip multicast-routinginterface Loopback0ip address 1.1.1.1 255.255.255.255ip pim sparse-modeinterface GigabitEthernet0/1no switchportip address 10.1.2.1 255.255.255.0ip pim sparse-modeip pim rp-address 1.1.1.1>> LEAF ROUTER (R2) <<ip multicast-routinginterface Loopback0ip address 2.2.2.2 255.255.255.255ip pim sparse-modeinterface GigabitEthernet0/2no switchportip address 10.1.2.2 255.255.255.0ip pim sparse-modeip pim rp-address 1.1.1.1 Configuration Reference Guide | [M] 340

Auto-RP • Multicast Routing: PIM Sparse Mode • Auto RP pointing to RP router • Auto RP IP will be 1.1.1.1 • Auto RP will announce multicast group 239.192.240.0 to all PIM enabled routers>> RP ROUTER <<ip multicast-routinginterface Loopback0ip address 1.1.1.1 255.255.255.255ip pim sparse-dense-modeinterface GigabitEthernet0/1no switchportip address 10.1.2.1 255.255.255.0ip pim sparse-modeaccess-list 1 permit 239.192.240.0 0.0.0.255ip pim send-rp-announce Loopback0 scope 16 group-list 1ip pim send-rp-discovery Loopback0 scope 16 Configuration Reference Guide | [M] 341

Solution/Services: Multicast: SecurityRelated: N/ARogue Source Protection • Configured on RP router (CS01) • Only Multicast servers (source) from the 192.168.20.0/24 network are permitted to announce Multicast networks 224.X.X.X for Multicast Registration to the RP router (CS01)ip access-list extended permitted-ucast-sourcespermit ip 192.168.20.0 0.0.0.255 224.0.0.0 15.255.255.255ip pim accept-register list permitted-ucast-sourcesRogue Source Protection for Auto-RP • Configured on RP router (CS01) • Specify the valid Auto-RP router(s) on the network • Specify valid multicast groups the Auto-RP can advertiseaccess-list 10 permit 1.1.1.1access-list 11 permit 239.192.240.10ip pim rp-announce-filter rp-list 10 group-list 11 Configuration Reference Guide | [M] 342

IGMP Group Security (On Routers) • Configured on Multicast routers with connected hosts that could join a multicast group. • Specify the multicast groups (239.192.240.10) that members off of the connected interface (VLAN10) can joinaccess-list 10 permit 239.192.240.10interface Vlan10ip address 192.168.10.1 255.255.255.0ip igmp access-group 10IGMP Filter (On Switches) • Configured on Cisco Catalyst Switches with connected hosts that could join a multicast group. • Specify the multicast groups (239.192.X.X.) that members off of GE0/1 can join>> AS01 <<access-list 1 permit 239.192.0.0 0.59.255.255interface GigabitEthernet0/1description TO: R1ip igmp filter 1RP Multicast Group Registration Protection • Specify what multicast groups (224.X.X.X) can register with the RP (CS01; 1.1.1.1)ip access-list standard ROUTEHUB-ACL-MCASTpermit 224.0.0.0 15.255.255.255ip pim rp-address 1.1.1.1 ROUTEHUB-ACL-MCAST override Configuration Reference Guide | [M] 343

Multicast Boundary Protection • Filter multicast groups (224.X.X.X) to not be transmitted nor received beyond the interface VLAN30ip access-list standard pim-local-domainpermit 224.0.0.0 15.255.255.255interface Vlan30ip address 192.168.30.1 255.255.255.0ip pim bsr-borderip multicast boundary pim-local-domainip multicast ttl-threshold 32 Configuration Reference Guide | [M] 344

Solution/Services: MulticastRelated: PIMMSDP • R1 exist in one Multicast domain acting as the RP • R2 exist in another Multicast domain acting as the RP • Configure MSDP to connect the two Multicast domains together>> R1 <<ip multicast-routinginterface Loopback0ip address 172.16.1.1 255.255.255.255ip pim sparse-modeinterface FastEthernet0/0ip address 1.1.1.1 255.255.255.0ip pim rp-address 172.16.1.1ip msdp peer 172.16.2.1 connect-source Loopback0ip msdp description 172.16.2.1 Connecting to remote RP routerip msdp cache-sa-stateip msdp originator-id Loopback0 Configuration Reference Guide | [M] 345

MSDP and MBGP (External Design) • MSDP and MBGP External Design Configuration Example • R1 (1.1.1.1) and R2 (2.2.2.2) exist in Multicast domain 1 where R1 is the RP • R3 (3.3.3.3) exist in Multicast domain 2 and acting as the RP • Configure MSDP to connect the two Multicast domains together • Reference: For additional Multicast Security go to “Multicast: Security”>> R1 <<ip multicast-routinginterface Loopback0ip address 1.1.1.1 255.255.255.255ip pim sparse-modeip pim rp-address 1.1.1.1ip msdp peer 3.3.3.3 connect-source Loopback0ip msdp description 3.3.3.3 ISP RP ROUTERip msdp cache-sa-stateip msdp originator-id Loopback0router bgp 6778 neighbor 10.1.3.3 remote-as 1address-family ipv4 neighbor 10.1.3.3 activate exit-address-familyaddress-family ipv4 multicast neighbor 10.1.3.3 activate no auto-summary exit-address-family Configuration Reference Guide | [M] 346

Redundancy using MSDP and Anycast (Internal Design) • MSDP Internal Design Configuration Example to provide RP Redundancy • CORE2 will be the Primary RP router and CORE1 will be the Secondary RP router • RP will be 1.0.0.1 (Anycast) • MSDP peer IP for CORE1 will be 1.1.1.1 (Loopback interface) • MSDP peer IP for Core2 will be 2.2.2.2 (Loopback interface) • Anycast RP will announce multicast group 239.0.0.0 to all PIM enabled routers • Reference: For additional Multicast Security go to “Multicast: Security”>> CORE1 <<ip multicast-routing distributedinterface Loopback0ip address 1.1.1.1 255.255.255.255ip pim sparse-modeinterface Loopback9ip address 1.0.0.1 255.255.255.255ip pim sparse-modeinterface GigabitEthernet1/0/1no switchportip address 10.1.2.1 255.255.255.0ip pim sparse-modeip access-list standard ROUTEHUB-ACL-MCASTpermit 239.0.0.0 0.255.255.255ip pim rp-address 1.0.0.1 ROUTEHUB-ACL-MCAST overrideip msdp peer 2.2.2.2 connect-source Loopback0ip msdp description 2.2.2.2 routehub-csr02ip msdp cache-sa-stateip msdp originator-id Loopback0ip msdp ttl-threshold 10.1.2.2 32access-list 100 permit ip 239.0.0.0 0.255.255.255 host 2.2.2.2ip msdp sa-filter out 2.2.2.2 list 100 Configuration Reference Guide | [M] 347

>> CORE2 <<ip multicast-routing distributedinterface Loopback0ip address 2.2.2.2 255.255.255.255ip pim sparse-modeinterface Loopback9ip address 1.0.0.1 255.255.255.255ip pim sparse-modeinterface GigabitEthernet1/0/1description CORE1no switchportip address 10.1.2.2 255.255.255.0ip pim sparse-modeinterface GigabitEthernet1/0/2description WAN-ROUTERno switchportip address 10.1.3.1 255.255.255.0ip pim sparse-modeip access-list standard ROUTEHUB-ACL-MCASTpermit 239.0.0.0 0.255.255.255ip pim rp-address 1.0.0.1 ROUTEHUB-ACL-MCAST overrideip msdp peer 1.1.1.1 connect-source Loopback0ip msdp description 1.1.1.1 routehub-csr01ip msdp cache-sa-stateip msdp originator-id Loopback0ip msdp ttl-threshold 10.1.2.1 32access-list 100 permit ip 239.0.0.0 0.255.255.255 host 1.1.1.1ip msdp sa-filter out 1.1.1.1 list 100 Configuration Reference Guide | [M] 348

>> OTHER ROUTERS & L3 SWITCHES <<hostname WAN-ROUTERip multicast-routinginterface loopback 0description \"network-mgmt\"ip address 3.3.3.3 255.255.255.255no ip redirectsno ip unreachablesno ip proxy-arpip pim sparse-modeinterface GigabitEthernet3/1description CORE2ip address 10.1.3.3 255.255.255.0no ip redirectsno ip unreachablesno ip proxy-arpip pim sparse-modeinterface Serial0/0.1 point-to-pointdescription WAN CLOUDip address 10.250.3.1 255.255.255.252no ip redirectsno ip unreachablesno ip proxy-arpip pim sparse-modeip access-list standard ROUTEHUB-ACL-MCASTpermit 239.0.0.0 0.255.255.255ip pim rp-address 1.0.0.1 ROUTEHUB-ACL-MCAST override Configuration Reference Guide | [M] 349

Solution/Services: Cisco Catalyst 6500 SeriesRelated: • NAM service module in slot 7 • NAM will use VLAN 99 for managing the service module • NAM module will capture traffic for VLANs 10-11,100-102analysis module 7 management-port access-vlan 99analysis module 7 data-port 1 capture allowed-vlan 10,100analysis module 7 data-port 2 capture allowed-vlan 11,101-102 Configuration Reference Guide | [N] 350