MPLS LDP Inbound Label Binding Filtering

Multiprotocol Label Switching (MPLS) Label Distribution Protocol (LDP) supports inbound label binding filtering. You can use the MPLS LDP Inbound Label Binding Filtering feature to configure access control lists (ACLs) for controlling the label bindings a label switch router (LSR) accepts from its peer LSRs.

Restrictions for MPLS LDP Inbound Label Binding Filtering

Inbound label binding filtering does not support extended access control lists (ACLs); it only supports standard ACLs.

Information about MPLS LDP Inbound Label Binding Filtering

Overview of MPLS LDP Inbound Label Binding Filtering

The MPLS LDP Inbound Label Binding Filtering feature can be used to control the amount of memory used to store Label Distribution Protocol (LDP) label bindings advertised by other devices. For example, in a simple Multiprotocol Label Switching (MPLS) Virtual Private Network (VPN) environment, the VPN provider edge (PE) devices might require label switched paths (LSPs) only to their peer PE devices (that is, they do not need LSPs to core devices). Inbound label binding filtering enables a PE device to accept labels only from other PE devices.

How to Configure MPLS LDP Inbound Label Binding Filtering

Configuring MPLS LDP Inbound Label Binding Filtering

Perform this task to configure a device for inbound label filtering. The following configuration allows the device to accept only the label for prefix 25.0.0.2 from the Label Distribution Protocol (LDP) neighbor device 10.12.12.12.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. ip access-list standard access-list-number
  4. permit {source [source-wildcard] | any} [log]
  5. exit
  6. mpls ldp neighbor [vrf vpn-name] nbr-address labels accept acl
  7. end

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:


Device> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 3

ip access-list standard access-list-number

Example:


Device(config)# ip access-list standard 1

Defines a standard IP access list with a number.

Step 4

permit {source [source-wildcard] | any} [log]

Example:


Device(config-std-nacl)# permit 10.0.0.0

Specifies one or more prefixes permitted by the access list.

Step 5

exit

Example:


Device(config-std-nacl)# exit

Returns to global configuration mode.

Step 6

mpls ldp neighbor [vrf vpn-name] nbr-address labels accept acl

Example:


Device(config)# mpls ldp neighbor 10.12.12.12 labels accept 1

Specifies the access control list (ACL) to be used to filter label bindings for the specified LDP neighbor.

Step 7

end

Example:


Device(config)# end

Returns to privileged EXEC mode.

Verifying that MPLS LDP Inbound Label Bindings are Filtered

If inbound filtering is enabled, perform the following tasks to verify that inbound label bindings are filtered.

SUMMARY STEPS

  1. enable
  2. show mpls ldp neighbor [vrf vpn-name] [address | interface] [detail]
  3. show ip access-list [access-list-number | access-list-name]
  4. show mpls ldp bindings
  5. exit

DETAILED STEPS

Step 1

enable

Enables privileged EXEC mode. Enter your password if prompted.

Example:


Device> enable
Device#

Step 2

show mpls ldp neighbor [vrf vpn-name] [address | interface] [detail]

Shows the status of the Label Distribution Protocol (LDP) session, including the name or number of the access control list (ACL) configured for inbound filtering.

Note

 

To display information about inbound label binding filtering, you must enter the detail keyword.

Example:


Device# show mpls ldp neighbor 10.12.12.12 detail
 Peer LDP Ident: 10.12.12.12:0; Local LDP Ident 10.13.13.13:0
   TCP connection: 10.12.12.12.646 - 10.13.13.13.12592
   State: Oper; Msgs sent/rcvd: 49/45; Downstream; Last TIB rev sent 1257
   Up time: 00:32:41; UID: 1015; Peer Id 0;
   LDP discovery sources:
    Serial1/0/0; Src IP addr: 192.168.1.1 
     holdtime: 15000 ms, hello interval: 5000 ms
   Addresses bound to peer LDP Ident:
    10.0.0.129       10.12.12.12     192.168.1.1 
   Peer holdtime: 180000 ms; KA interval: 60000 ms; Peer state: estab
   LDP inbound filtering accept acl: 1

Step 3

show ip access-list [access-list-number | access-list-name]

Displays the contents of all current IP access lists or of a specified access list.

Note

 

It is important that you enter this command to see how the access list is defined; otherwise, you cannot verify inbound label binding filtering.

The following command output shows the contents of IP access list 1:

Example:


Device# show ip access 1
Standard IP access list 1
  permit 10.0.0.0, wildcard bits 0.0.0.255 (1 match)

Step 4

show mpls ldp bindings

Verifies that the label switch router (LSR) has remote bindings only from a specified peer for prefixes permitted by the access list.

Example:


Device# show mpls ldp bindings
 tib entry: 10.0.0.0/8, rev 4
     local binding:  tag: imp-null
 tib entry: 10.2.0.0/16, rev 1137
     local binding:  tag: 16
 tib entry: 10.2.0.0/16, rev 1139
     local binding:  tag: 17
 tib entry: 10.12.12.12/32, rev 1257
     local binding:  tag: 18
 tib entry: 10.13.13.13/32, rev 14
     local binding:  tag: imp-null
 tib entry: 10.10.0.0/16, rev 711
     local binding:  tag: imp-null
 tib entry: 10.0.0.0/8, rev 1135
     local binding:  tag: imp-null
     remote binding: tsr: 10.12.12.12:0, tag: imp-null
 tib entry: 10.0.0.0/8, rev 8
     local binding:  tag: imp-null

Step 5

exit

Returns to user EXEC mode.

Example:


Device# exit
Device>

Configuration Examples for MPLS LDP Inbound Label Binding Filtering

Examples: MPLS LDP Inbound Label Binding Filtering Configuration

In the following example, the mpls ldp neighbor labels accept command is configured with an access control list to filter label bindings received on sessions with the neighbor 10.110.0.10.

Label bindings for prefixes that match 10.b.c.d are accepted, where b is less than or equal to 63, and c and d can be any integer between 0 and 128. Other label bindings received from 10.110.0.10 are rejected. 


Device# configure terminal
Device(config)# access-list 1 permit 10.63.0.0 0.63.255.255 
Device(config)# mpls ldp neighbor 10.110.0.10 labels accept 1  
Device(config)# end

In the following example, the show mpls ldp bindings neighbor command displays label bindings that were learned from 10.110.0.10. This example verifies that the LIB does not contain label bindings for prefixes that have been excluded. 


Device# show mpls ldp bindings neighbor 10.110.0.10

tib entry: 10.2.0.0/16, rev 4
    remote binding: tsr: 10.110.0.10:0, tag: imp-null
tib entry: 10.43.0.0/16, rev 6
    remote binding: tsr: 10.110.0.10:0, tag: 16
tib entry: 10.52.0.0/16, rev 8
    remote binding: tsr: 10.110.0.10:0, tag: imp-null

Additional References

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Command List, All Releases

MPLS commands

Cisco IOS Multiprotocol Label Switching Command Reference

MPLS Label Distribution Protocol (LDP)

“MPLS Label Distribution Protocol” module in the MPLS Label Distribution Protocol Configuration Guide

MIBs

MIB

MIBs Link

LDP Specification, draft-ietf-mpls-ldp-08.txt

To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mib

RFCs

RFC

Title

RFC 3036

LDP Specification

RFC 3037

LDP Applicability

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Feature Information for MPLS LDP Inbound Label Binding Filtering

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Glossary

carrier supporting carrier —A situation where one service provider allows another service provider to use a segment of its backbone network. The service provider that provides the segment of the backbone network to the other provider is called the backbone carrier. The service provider that uses the segment of the backbone network is called the customer carrier.

CE device —customer edge device. A device that is part of a customer network and that interfaces to a provider edge (PE) device.

inbound label binding filtering —Allows label switch routers (LSRs) to control which label bindings it will accept from its neighboring LSRs. Consequently, an LSR does not accept or store some label bindings that its neighbors advertise.

label —A short fixed-length identifier that tells switching nodes how to forward data (packets or cells).

label binding —An association between a destination prefix and a label.