ISIS Database Reading

 

ISIS is simple to operate normally while everything is working, most common deployments are flat network based on L2, however when there is a problem and we need to start troubleshooting then people start to get lost.

So I would like to provide some tools on how to read ISIS database.

 

• notice to the “*” sign, that mean LSP was generated on the router you did the show command, you can see that host name from the show command match also host name on the LSPID,
• LSPID identified by hostname.xx-yy,  xx is normally 00 unless that LSP is pseudo node LSP generated by DIS , yy is representing the number of fragments for that LSP 00 – FF (max 255 fragments, plenty), most cases all the important information will be in 00 unless there are many fragments.
• LSP Holdtime is the amount of time an LSP will stay in database without any refresh.
• ATT/P/OL - 0/0/0, ATT bit or attached bit is used on L1/L2 connected to L1 node, if set to 1 L1 node will generate default route to the best L1/L2 node (best metric)
• ATT/P/OL - 0/0/0, OL bit or overload bit, in the past it was used when router was over loaded to set all links on the router as unusable, preventing others from transiting, that node, today it is used mostly to wait for bgp convergence.

 

P_london_someisp.net#show isis database 
IS-IS Level-2 Link State Database:
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL
P_london_somei.00-00* 0x00000005   0x65C5        1177              0/0/0
P_dublin_somei.00-00  0x00000004   0x8346        1176              0/0/0
P_cyprus_somei.00-00  0x00000005   0x5634        1183              0/0/0
P_LA_someisp.n.00-00  0x00000005   0xDE33        1175              0/0/0
PE_newyork_som.00-00  0x00000003   0x2EF0        1179              0/0/0
PE_telaviv_som.00-00  0x00000004   0x2877        1181              0/0/0
PE_Jerusalem_s.00-00  0x00000002   0x2994        1172              0/0/0
PE_Jerusalem_s.02-00  0x00000001   0x2ED2        1171              0/0/0

From the database each router build a topology using SPF (dijkstra algorithm), if I would like to understand how to get from one router to another I can look into the ISIS database detail and understand that:

For the example, I would like to see only with the database, how to get from my self
to PE_telaviv without looking into the topology or routing table (just for fun): 
Notice that according to my LSP I can see the neighbors I am connected to, and the net address
for each link along with metric.
P_london_someisp.net#$atabase  level-2 det P_london_someisp.net.00-00   
IS-IS Level-2 LSP P_london_somei.00-00
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL
P_london_somei.00-00* 0x00000006   0x63C6        409               0/0/0
  Area Address: 49.0001
  NLPID:        0xCC 
  Hostname: P_london_someisp.net
  IP Address:   1.1.1.1
  Metric: 10         IS-Extended P_dublin_somei.00
  Metric: 10         IS-Extended P_cyprus_somei.00
  Metric: 10         IS-Extended P_LA_someisp.n.00
  Metric: 10         IS-Extended PE_newyork_som.00
  Metric: 10         IP 1.1.1.1/32
  Metric: 10         IP 10.100.1.4/30
  Metric: 10         IP 10.100.1.16/30
  Metric: 10         IP 10.100.1.20/30
  Metric: 10         IP 10.100.1.24/30
P_london_someisp.net#
 
 
now if I take the first neighbor from my LSP P_dublin and look into his LSP:
notice that one of his neighbors is PE_telaviv.
So 10 to reach dublin + 10 to reach telaviv = 20 total cost from london to telaviv 
I have taken the next neighbor cyprus and it looks like we have also 20 metric path using 
cyprus, so we will have load sharing between them.
notice that P_LA and PE_newyork does not have direct link to PE_telaviv, that mean we do not
need to explorer more in that direction as any route using them will have higher cost.
 
 
P_london_someisp.net#$atabase  level-2 det P_dublin_someisp.net.00-00
IS-IS Level-2 LSP P_dublin_somei.00-00
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL
P_dublin_somei.00-00  0x00000006   0x7F48        1077              0/0/0
  Area Address: 49.0001
  NLPID:        0xCC 
  Hostname: P_dublin_someisp.net
  IP Address:   2.2.2.2
  Metric: 10         IS-Extended P_london_somei.00
  Metric: 10         IS-Extended P_cyprus_somei.00
  Metric: 10         IS-Extended P_LA_someisp.n.00
  Metric: 10         IS-Extended PE_telaviv_som.00
  Metric: 10         IP 2.2.2.2/32
  Metric: 10         IP 10.100.1.0/30
  Metric: 10         IP 10.100.1.12/30
  Metric: 10         IP 10.100.1.16/30
  Metric: 10         IP 10.100.1.36/30
P_london_someisp.net#$atabase  level-2 det P_cyprus_someisp.net.00-00
IS-IS Level-2 LSP P_cyprus_somei.00-00
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL
P_cyprus_somei.00-00  0x00000007   0x5236        854               0/0/0
  Area Address: 49.0001
  NLPID:        0xCC 
  Hostname: P_cyprus_someisp.net
  IP Address:   3.3.3.3
  Metric: 10         IS-Extended P_london_somei.00
  Metric: 10         IS-Extended P_dublin_somei.00
  Metric: 10         IS-Extended P_LA_someisp.n.00
  Metric: 10         IS-Extended PE_telaviv_som.00
  Metric: 10         IS-Extended PE_Jerusalem_s.02
  Metric: 10         IP 3.3.3.3/32
  Metric: 10         IP 10.100.1.0/30
  Metric: 10         IP 10.100.1.4/30
  Metric: 10         IP 10.100.1.8/30
  Metric: 10         IP 10.100.1.32/30
  Metric: 10         IP 20.0.0.0/24
P_london_someisp.net#$atabase  level-2 det P_LA_someisp.net.00-00    
IS-IS Level-2 LSP P_LA_someisp.n.00-00
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL
P_LA_someisp.n.00-00  0x00000007   0xDA35        690               0/0/0
  Area Address: 49.0001
  NLPID:        0xCC 
  Hostname: P_LA_someisp.net
  IP Address:   4.4.4.4
  Metric: 10         IS-Extended P_london_somei.00
  Metric: 10         IS-Extended P_dublin_somei.00
  Metric: 10         IS-Extended P_cyprus_somei.00
  Metric: 10         IS-Extended PE_newyork_som.00
  Metric: 10         IP 4.4.4.4/32
  Metric: 10         IP 10.100.1.8/30
  Metric: 10         IP 10.100.1.12/30
  Metric: 10         IP 10.100.1.20/30
  Metric: 10         IP 10.100.1.28/30
P_london_someisp.net#show isis database  level-2 det PE_newyork_someisp.net.00$
IS-IS Level-2 LSP PE_newyork_som.00-00
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL
PE_newyork_som.00-00  0x00000005   0x2AF2        499               0/0/0
  Area Address: 49.0001
  NLPID:        0xCC 
  Hostname: PE_newyork_someisp.net
  IP Address:   5.5.5.5
  Metric: 10         IS P_london_somei.00
  Metric: 10         IS P_LA_someisp.n.00
  Metric: 10         IS-Extended P_london_somei.00
  Metric: 10         IS-Extended P_LA_someisp.n.00
  Metric: 10         IP 5.5.5.5/32
  Metric: 10         IP 10.100.1.24/30
  Metric: 10         IP 10.100.1.28/30
  Metric: 10         IP 5.5.5.5 255.255.255.255
  Metric: 10         IP 10.100.1.24 255.255.255.252
  Metric: 10         IP 10.100.1.28 255.255.255.252
 
 
To see the topology now and see if we are on the right track, notice that we are correct 20 metric
one with dublin and the other trough cyprus with 20 metric doing load sharing.
 
 
P_london_someisp.net#show isis topology 
IS-IS paths to level-2 routers
System Id            Metric     Next-Hop             Interface   SNPA
P_london_someisp.net --
P_dublin_someisp.net 10         P_dublin_someisp.net Se1/2       *HDLC*         
P_cyprus_someisp.net 10         P_cyprus_someisp.net Se1/1       *HDLC*         
P_LA_someisp.net     10         P_LA_someisp.net     Se1/0       *HDLC*         
PE_newyork_someisp.ne10         PE_newyork_someisp.neMu1         *PPP*          
PE_telaviv_someisp.ne20         P_dublin_someisp.net Se1/2       *HDLC*         
                                P_cyprus_someisp.net Se1/1       *HDLC*         
PE_Jerusalem_someisp.20         P_cyprus_someisp.net Se1/1       *HDLC*         

ISIS - Intermediate System to Intermediate System Intro

 

There is much information about ISIS history and present state, when I want to study something new I am looking for the small bullets that make subject easier to understand, once I got the basics I am taking each point and digging into it, here I would like to give the key elements for understanding ISIS and I would have to say  from the start that every point can be elaborated into at least an article if not a book (exaggerating) by itself:

• ISIS link state protocol (most important key to start with and easiest to remember)
• ISO protocol working based on CLNP (Connection Less Network Protocol)
• Support IP Routing
• Router (Node or IS) Addressing use 8 – 20 byte hex format address ( AREA + SYS-ID + NSEL )
• ISIS have 2 hierarchy called Level 1 and Level 2
• IS can be either Level 1 or Level 2 or Level 1 + 2
• Level 1 may only have neighbor relations within the same area and only with L1 or L1 + L2 IS
• Level 2 may establish neighbors relation with other areas, Level 2 also refer to as backbone (some time compared to OSPF area 0)
• In case level-1-2 is used and the neighbor IS is also level-1-2 and both systems are in the same area, the IS will form 2 neighbors 1 for Level 1 and another for Level 2.
• DIS – Designated IS very similar to DR function in OSPF to reduce the size of the database and allowing efficient scalability, one exist in every broadcast domain and level
• DIS is preemptive eligible meaning that is a IS will come up with stronger parameters it will take the DIS role
• Only 2 types of interfaces, broadcast and point to point
• Authentication can be done separately on Hello messages or link state updates
• Support extensions using different TLV’s (Type length value) like Graceful restart, TE…

 

What you see from below is that R3 is the the DIS, according to the pseudonode see at the bottom of the output generated by the DIS LSP with metric 0 to each of the routers on the LAN.
 
R1#show isis database detail
IS-IS Level-1 Link State Database:
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL
R1.00-00            * 0x00000006   0x1919        1114              0/0/0
  Area Address: 49.0001
  NLPID:        0xCC
  Hostname: R1
  IP Address:   10.123.0.1
  Metric: 10         IP 10.123.0.0 255.255.255.0
  Metric: 10         IS R3.01
R2.00-00              0x00000004   0x0CBF        1165              0/0/0
  Area Address: 49.0001
  NLPID:        0xCC
  Hostname: R2
  IP Address:   10.123.0.2
  Metric: 10         IP 10.123.0.0 255.255.255.0
  Metric: 10         IS R3.01
R3.00-00              0x00000004   0xFA68        960               0/0/0
  Area Address: 49.0001
  NLPID:        0xCC
  Hostname: R3
  IP Address:   10.123.0.3
  Metric: 10         IP 10.123.0.0 255.255.255.0
  Metric: 10         IS R3.01
R3.01-00              0x00000004   0x3195        1101              0/0/0
  Metric: 0          IS R3.00
  Metric: 0          IS R1.00
  Metric: 0          IS R2.00
IS-IS Level-2 Link State Database:
LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL
R1.00-00            * 0x00000007   0x0E23        1004              0/0/0
  Area Address: 49.0001
  NLPID:        0xCC
  Hostname: R1
  IP Address:   10.123.0.1
  Metric: 10         IS R3.01
  Metric: 10         IP 10.123.0.0 255.255.255.0
R2.00-00              0x00000003   0x05C7        354               0/0/0
  Area Address: 49.0001
  NLPID:        0xCC
  Hostname: R2
  IP Address:   10.123.0.2
  Metric: 10         IS R3.01
  Metric: 10         IP 10.123.0.0 255.255.255.0
R3.00-00              0x00000004   0xF171        1120              0/0/0
  Area Address: 49.0001
  NLPID:        0xCC
  Hostname: R3
  IP Address:   10.123.0.3
  Metric: 10         IS R3.01
  Metric: 10         IP 10.123.0.0 255.255.255.0
R3.01-00              0x00000004   0xE26C        1180              0/0/0
  Metric: 0          IS R3.00
  Metric: 0          IS R1.00
  Metric: 0          IS R2.00
R1#
 

MPLS VPN

 

Ok now the fun stuff start, MPLS VPN’s, I have created nice topology with ISP “someisp.net” and two customers that have connected their branches in NY and Tel Aviv, “google.net” a small company and “shirannet.net” an innovative company working Native IPv6.

Now this time I would go in a different approach instead of talking and talking (I mean writing and writing) I will give you all configurations and .net file I did and let you play around.

MPLS VPN Topology configuration + .net

Some pointers:

1) You can divide the topology into 2 main sections Provider and Customer and 3 virtual divisions (explained below):

a) Provider Back Bone, relatively simple configuration P router are set only with IGP (OSPF flat area 0)
b) PE’s are the complex part, holding both the Customer Interconnecting protocol Provider Topology and doing the conversion between them.
c) Customer Edge again simple configuration

2) ttl propagation in the configuration files I have provided you I have left the default behavior of ttl propagation where the inner ttl field (original packet) is decremented along the path reveling Service Provider path, normally it is not what you will have, and the way to change that behavior is very simple with single command on each PE router see below example:

PE_newyork_someisp.n(config)#no mpls ip propagate-ttl

another scenario is where “shirannet.net” customer is using native IPv6 and you will notice that if you perform a trace and and the ttl propagation is enabled your trace will not function properly and that is because the backbone routers P routers are not IPv6 enabled at all they do not know what is IPv6!!!

! Before diableing ttl propagation 
CE_newyork_shirannet.net#traceroute  2001:CE72:68::2
Type escape sequence to abort.
Tracing the route to 2001:CE72:68::2
  1 2001:CE92:68::1 52 msec 16 msec 8 msec
  2  *  *  *
  3  *
CE_newyork_shirannet.net#ping  2001:CE72:68::2
!
! altoug there is nothing wrong with End To End Connectivity
!
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:CE72:68::2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/64/88 ms
!
! After diableing ttl propagation also trace is fine :-)
!
CE_newyork_shirannet.net#traceroute  2001:CE72:68::2
Type escape sequence to abort.
Tracing the route to 2001:CE72:68::2
  1 2001:CE92:68::1 36 msec 36 msec 24 msec
  2 2001:CE72:68::1 52 msec 56 msec 32 msec
  3 2001:CE72:68::2 52 msec 48 msec 60 msec
CE_newyork_shirannet.net#traceroute  2001:CE72:68::2

 

3) Another last thing I would like to point your attention again concerning IPv6, notice to the vrf configuration, using the new method:

! This is the new way of define vrf's and the only supported
! When working with IPv6 and vrf's
vrf definition shirannet.net
 rd 20000:40
 route-target export 20000:40
 route-target import 20000:40
 !
 address-family ipv6
 exit-address-family
!
!I did both methods just to get your attention on both ways
!
ip vrf google.net
 rd 10000:80
 route-target export 10000:80
 route-target import 10000:80
!

 

Ok, That is it I hope you will have fun, I think that the basic configuration will allow you to play and test all kind of scenarios and get better understanding on the subject.

IPV6 NAT-PT Dynamic

 

IPv6 NAT-PT is one of the methods out there for migration between V4 to V6, the NAT-PT is not a normal NAT as with normal NAT you would translate one address to another, in our case NAT-PT we do a translation between 2 different protocols ipv6 to ipv4 (and vice versa).

In the above scenario I have done a simple topology R1 is a host running only IPv6, R2 is my translator between IPv6 to IPv4 and R3 is my gateway out side (Only IPv4), on R3 as you can see from above I have connected it to my home network so I have done Normal IPv4 NAT between the what is coming in from f0/0 and going out f0/1 (my home net)

R1	R2	R3
! interface FastEthernet0/0 no ip address duplex auto speed auto ipv6 address 2001:100:100::1/64 ipv6 address FE80::1 link-local ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! ! ! ip http server no ip http secure-server ! ipv6 route ::/0 2001:100:100::2 ! !	! ! ! ipv6 unicast-routing ! ! interface FastEthernet0/0 no ip address duplex auto speed auto ipv6 address 2001:100:100::2/64 ipv6 address FE80::2 link-local ipv6 nat ! interface FastEthernet0/1 ip address 100.100.0.1 255.255.255.0 duplex auto speed auto ipv6 nat ! ip route 0.0.0.0 0.0.0.0 100.100.0.2 ! ! ip http server no ip http secure-server ! ipv6 nat v6v4 source list NAT_TRANSLATIONS pool V4POOL ipv6 nat v6v4 pool V4POOL 100.100.0.101 100.100.0.110 prefix-length 24 ipv6 nat prefix 2001::/96 v4-mapped NAT_TRANSLATIONS ! ! ! ! ipv6 access-list NAT_TRANSLATIONS permit ipv6 any 2001::/96 !	! ! ! interface FastEthernet0/0 ip address 100.100.0.2 255.255.255.0 ip nat inside ip virtual-reassembly duplex auto speed auto ! interface FastEthernet0/1 ip address dhcp ip nat outside ip virtual-reassembly duplex auto speed auto ! ! ! ip http server no ip http secure-server ip nat inside source list 100 interface FastEthernet0/1 overload ! access-list 100 permit ip 100.100.0.0 0.0.0.255 any !

 

As you can see from above configuration R1 in IPv6 only, and R3 is IPv4 only

IPV6_HOST#ping 2001::808:808
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001::808:808, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 128/142/184 ms
IPV6_HOST#
From above you can see I ping 2001::808:808, the 2001:: is the prefix I use
for the NAT-PT and the 32 last bits 0808:0808 is translated to 8.8.8.8 (Google DNS)

to verify the translation on the NAT-PT router:

NAT_PT_ROUTER#sh ipv nat translations
Prot  IPv4 source              IPv6 source
      IPv4 destination         IPv6 destination
---   ---                      ---
      10.0.0.2                 2001::A00:2
icmp  100.100.0.102,3764       2001:100:100::1,3764
      8.8.8.8,3764             2001::808:808,3764
---   100.100.0.102            2001:100:100::1
      10.0.0.2                 2001::A00:2
---   100.100.0.102            2001:100:100::1
      ---                      ---
NAT_PT_ROUTER#debug ipv6 nat
IPv6 NAT-PT debugging is on
NAT_PT_ROUTER#
*Mar  1 14:12:06.104: IPv6 NAT: icmp src (2001:100:100::1) -> (100.100.0.102), dst (2001::808:808) -> (8.8.8.8)
*Mar  1 14:12:06.236: IPv6 NAT: icmp src (8.8.8.8) -> (2001::808:808), dst (100.100.0.102) -> (2001:100:100::1)
*Mar  1 14:12:06.256: IPv6 NAT: icmp src (8.8.8.8) -> (2001::808:808), dst (100.100.0.102) -> (2001:100:100::1)
*Mar  1 14:12:06.264: IPv6 NAT: icmp src (8.8.8.8) -> (2001::808:808), dst (100.100.0.102) -> (2001:100:100::1)
*Mar  1 14:12:06.280: IPv6 NAT: icmp src (8.8.8.8) -> (2001::808:808), dst (100.100.0.102) -> (2001:100:100::1)
default timeout for the translation rule to expire from the table is 60 sec, to save some
work from the router i would suggest to increase that timeout
ipv nat translation timeout 300 (increase to 5 min)
now with that said you can increase or decrease timeout for tcp , udp , icmp , I would love if there would be also the
option to specifically decrease the timeout for SYN (prevent from SYN flood attack) currently there is an option only 
for FIN or RST flags (and I suggest to decrease their time out.
ipv nat translation finrst-timeout 10 

BGP FREE CORE

 

In this article I would like to demonstrate the BGP free core power , the simplicity for the ISP as well as for the customer need to have site to site connectivity with out him creating vpns or doing any complex configuration.

R1_VRF_CCIE	R2_VRF_CCIE	R2_VRF_CCDE	R1_VRF_CCDE
R1_VRF_CCIE#sh run Building configuration... Current configuration : 641 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R1_VRF_CCIE ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ! ! ip cef ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface Loopback0 ip address 1.1.1.1 255.255.255.255 ! interface FastEthernet0/0 ip address 1.1.13.1 255.255.255.0 duplex auto speed auto ! router rip version 2 network 1.0.0.0 no auto-summary ! ip http server no ip http secure-server ! ! ! ! ! ! control-plane ! ! ! ! ! ! ! ! ! ! line con 0 exec-timeout 0 0 line aux 0 line vty 0 4 login ! ! end R1_VRF_CCIE#	R2_VRF_CCIE#sh run Building configuration... Current configuration : 717 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R2_VRF_CCIE ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ! ! ip cef ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface Loopback0 ip address 2.2.2.2 255.255.255.255 ! interface Loopback1 ip address 1.1.22.2 255.255.255.255 ! interface FastEthernet0/0 ip address 1.1.42.2 255.255.255.0 duplex auto speed auto ! router rip version 2 network 1.0.0.0 network 2.0.0.0 no auto-summary ! ip http server no ip http secure-server ! ! ! ! ! ! control-plane ! ! ! ! ! ! ! ! ! ! line con 0 exec-timeout 0 0 line aux 0 line vty 0 4 login ! ! end R2_VRF_CCIE#	R2_VRF_CCDE#sh run Building configuration... Current configuration : 1011 bytes ! version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname R2_VRF_CCDE ! boot-start-marker boot-end-marker ! ! ip subnet-zero ip cef ! ! ! no mpls traffic-eng auto-bw timers frequency 0 call rsvp-sync ! ! ! ! ! ! ! ! interface Loopback0 ip address 8.8.8.8 255.255.255.255 no clns route-cache ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto no clns route-cache ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto no clns route-cache ! interface ATM1/0 no ip address no atm enable-ilmi-trap no clns route-cache ! interface ATM1/0.1 point-to-point ip address 1.1.48.8 255.255.255.0 no atm enable-ilmi-trap pvc 0/201 encapsulation aal5snap ! ! router eigrp 100 network 0.0.0.0 no auto-summary ! ip classless ! no ip http server ! ! ! ! ! ! control-plane ! ! dial-peer cor custom ! ! ! ! line con 0 exec-timeout 0 0 stopbits 1 line aux 0 stopbits 1 line vty 0 4 no login ! ! end	R1_VRF_CCDE#sh run Building configuration... Current configuration : 1360 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R1_VRF_CCDE ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface Loopback0 ip address 6.6.6.6 255.255.255.255 ip ospf 1 area 0 ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface Serial0/0 ip address 1.1.67.6 255.255.255.0 encapsulation frame-relay ip ospf priority 0 ip ospf 1 area 0 clock rate 2000000 frame-relay map ip 1.1.67.3 201 broadcast no frame-relay inverse-arp ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface Serial0/1 no ip address shutdown clock rate 2000000 ! interface Serial0/2 no ip address shutdown clock rate 2000000 ! interface Serial1/0 no ip address shutdown serial restart-delay 0 ! interface Serial1/1 no ip address shutdown serial restart-delay 0 ! interface Serial1/2 no ip address shutdown serial restart-delay 0 ! interface Serial1/3 no ip address shutdown serial restart-delay 0 ! router ospf 1 router-id 6.6.6.6 log-adjacency-changes ! ! ! ip http server no ip http secure-server ! ! ! ! ! control-plane ! ! ! ! ! ! ! ! ! ! line con 0 exec-timeout 0 0 line aux 0 line vty 0 4 login ! ! end R1_VRF_CCDE#

 

you can see in the configuration there is no VRF configured, I only called them VFR routers as this are the CE connected to the ISP PE routers.

below you can see CE for CCIE the path from R1 to R2 can be (R1 –> R3 –> R4 –> R2) or ( R1 –> R3 –>R5 –> R4 –> R2 )

 

R1_VRF_CCIE#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     1.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
C       1.1.1.1/32 is directly connected, Loopback0
C       1.1.13.0/24 is directly connected, FastEthernet0/0
R       1.1.22.2/32 [120/1] via 1.1.13.3, 00:00:11, FastEthernet0/0
R       1.1.42.0/24 [120/1] via 1.1.13.3, 00:00:11, FastEthernet0/0
     2.0.0.0/32 is subnetted, 1 subnets
R       2.2.2.2 [120/1] via 1.1.13.3, 00:00:11, FastEthernet0/0
R1_VRF_CCIE#ping 2.2.2.2 sou
R1_VRF_CCIE#ping 2.2.2.2 source lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 60/77/120 ms
R1_VRF_CCIE#

R1_VRF_CCIE#traceroute 2.2.2.2 source lo0
Type escape sequence to abort.
Tracing the route to 2.2.2.2
  1 1.1.13.3 32 msec 16 msec 24 msec
  2 1.1.42.4 [MPLS: Labels 19 Exp 0] 28 msec 48 msec 40 msec
  3 1.1.42.2 72 msec *  72 msec
R1_VRF_CCIE#
R1_VRF_CCIE#traceroute 2.2.2.2 source lo0
Type escape sequence to abort.
Tracing the route to 2.2.2.2
  1 1.1.13.3 20 msec 28 msec 16 msec
  2 1.1.35.5 [MPLS: Labels 18/19 Exp 0] 96 msec 80 msec 68 msec
  3 1.1.42.4 [MPLS: Label 19 Exp 0] 68 msec 40 msec 40 msec
  4 1.1.42.2 64 msec *  76 msec
R1_VRF_CCIE#
 

 

I the above trace I have demonstrated the 2 path selection, the first it the natural selection and just by shutting the interface between R3 to R4 I have enforced the routers to select the other path (only to show that both paths are valid and working), please noting another interesting thing is to that we see the MPLS path In the next article I will show you how to keep that information out from the customer need to know but as for this demonstration it help me show you how dose it work.

now we see that the CE is simply configured with ip address under the interface (along with the proper L2 configuration) and IGP again that is another decision I made for simplicity, the next step will be to demonstrate a multi home mode however lets not get ahead of our self.

So lets look how is the ISP configured:

R3#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     1.0.0.0/24 is subnetted, 3 subnets
C       1.1.35.0 is directly connected, Serial1/1
C       1.1.43.0 is directly connected, Serial1/0
O       1.1.45.0 [110/128] via 1.1.43.4, 00:10:44, Serial1/0
                 [110/128] via 1.1.35.5, 00:10:44, Serial1/1
     3.0.0.0/32 is subnetted, 1 subnets
C       3.3.3.3 is directly connected, Loopback0
     4.0.0.0/32 is subnetted, 1 subnets
O       4.4.4.4 [110/65] via 1.1.43.4, 00:10:44, Serial1/0
     5.0.0.0/32 is subnetted, 1 subnets
O       5.5.5.5 [110/65] via 1.1.35.5, 00:10:44, Serial1/1
# Where is the router to 2.2.2.2 and to 1.1.1.1???!
# Remmeber the VRF?!
R3#sh ip route vrf CCIE
Routing Table: CCIE
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     1.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
R       1.1.1.1/32 [120/1] via 1.1.13.1, 00:00:15, FastEthernet0/0
C       1.1.13.0/24 is directly connected, FastEthernet0/0
B       1.1.22.2/32 [200/1] via 4.4.4.4, 4d22h
B       1.1.42.0/24 [200/0] via 4.4.4.4, 4d22h
     2.0.0.0/32 is subnetted, 1 subnets
B       2.2.2.2 [200/1] via 4.4.4.4, 4d22h
R3#
# OK now I can see the routes, but wait I do not have BGP
# Configured on my customers!!!

OK so how dose that work in our topology CE to PE we have IGP configured, On the PE I have the IGP to form route distribution with CE’s, I have IGP to between all the ISP routers only for internal and LDP / TDP (MPLS lable mapping) and I have BGP for distributing Customer routes to the IGP, now you ask your self , YOU SAID this should be BGP FREE ???! please noting to the headline is say BGP FREE CORE and by core I refer to all internal ISP network, in my diagram you can see only one core router R5 however ISP’s are build with far more complex and their core may contain a little more than that.

So lets see what we have on R5 as I have demonstrated an instance where the path is using him :

R5#sh ip route vrf *
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     1.0.0.0/24 is subnetted, 3 subnets
C       1.1.35.0 is directly connected, Serial0/1
O       1.1.43.0 [110/128] via 1.1.45.4, 00:24:19, Serial0/0
                 [110/128] via 1.1.35.3, 00:24:19, Serial0/1
C       1.1.45.0 is directly connected, Serial0/0
     3.0.0.0/32 is subnetted, 1 subnets
O       3.3.3.3 [110/65] via 1.1.35.3, 00:24:19, Serial0/1
     4.0.0.0/32 is subnetted, 1 subnets
O       4.4.4.4 [110/65] via 1.1.45.4, 00:24:19, Serial0/0
     5.0.0.0/32 is subnetted, 1 subnets
C       5.5.5.5 is directly connected, Loopback0
R5#
# AS You can see there is only main routing table no VRF 
# 
R5#sh ip protocols
Routing Protocol is "ospf 1"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Router ID 5.5.5.5
  Number of areas in this router is 1. 1 normal 0 stub 0 nssa
  Maximum path: 4
  Routing for Networks:
    1.1.35.5 0.0.0.0 area 0
    1.1.45.5 0.0.0.0 area 0
    5.5.5.5 0.0.0.0 area 0
 Reference bandwidth unit is 100 mbps
  Routing Information Sources:
    Gateway         Distance      Last Update
    2.2.2.2              110      5d21h
    1.1.1.1              110      6d00h
    3.3.3.3              110      00:25:24
    4.4.4.4              110      00:25:24
  Distance: (default is 110)
R5#
# Only OSPF of the main table! used as I have mentiond for
# Internal ISP communication and LDP / TDP (MPLS lable mapping)

R5#sh mpls forwarding-table
Local  Outgoing    Prefix            Bytes tag  Outgoing   Next Hop
tag    tag or VC   or Tunnel Id      switched   interface
16     Pop tag     1.1.43.0/24       0          Se0/0      point2point
       Pop tag     1.1.43.0/24       0          Se0/1      point2point
17     Pop tag     3.3.3.3/32        4764362    Se0/1      point2point
18     Pop tag     4.4.4.4/32        5707479    Se0/0      point2point
R5#

You can also see the MPLS table is very small the only thing R5 need to know is what to do when receiving label 16 , 17 , 18  

R3#sh run Building configuration... Current configuration : 2839 bytes ! version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname R3 ! boot-start-marker boot-end-marker ! ! ip subnet-zero ip cef ! ! no ip domain-lookup ! ip vrf CCDE rd 333:2 route-target export 1001:11 route-target import 1001:11 ! ip vrf CCIE rd 333:1 route-target export 10000:1 route-target import 10001:1 ! no mpls traffic-eng auto-bw timers frequency 0 call rsvp-sync ! ! ! ! ! ! ! ! interface Loopback0 ip address 3.3.3.3 255.255.255.255 no clns route-cache ! interface Loopback1 ip vrf forwarding CCDE ip address 33.3.3.3 255.255.255.255 no clns route-cache ! interface FastEthernet0/0 ip vrf forwarding CCIE ip address 1.1.13.3 255.255.255.0 duplex auto speed auto no clns route-cache ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto no clns route-cache ! interface Serial1/0 ip address 1.1.43.3 255.255.255.0 mpls ip serial restart-delay 0 no clns route-cache ! interface Serial1/1 ip address 1.1.35.3 255.255.255.0 mpls ip serial restart-delay 0 no clns route-cache ! interface Serial1/2 no ip address encapsulation frame-relay serial restart-delay 0 no frame-relay inverse-arp no clns route-cache ! interface Serial1/2.2 multipoint ip vrf forwarding CCDE ip address 1.1.67.3 255.255.255.0 frame-relay map ip 1.1.67.6 102 broadcast frame-relay map ip 1.1.67.7 103 broadcast ! interface Serial1/3 no ip address shutdown serial restart-delay 0 no clns route-cache ! router ospf 2 vrf CCDE router-id 33.3.3.3 log-adjacency-changes redistribute bgp 10000 subnets network 1.1.67.3 0.0.0.0 area 0 network 33.3.3.3 0.0.0.0 area 0 neighbor 1.1.67.7 neighbor 1.1.67.6 ! router ospf 1 router-id 3.3.3.3 log-adjacency-changes network 1.1.13.3 0.0.0.0 area 0 network 1.1.35.3 0.0.0.0 area 0 network 1.1.43.3 0.0.0.0 area 0 network 3.3.3.3 0.0.0.0 area 0 ! router rip ! address-family ipv4 vrf CCIE redistribute bgp 10000 metric 1 network 1.0.0.0 no auto-summary version 2 exit-address-family ! router bgp 10000 no bgp default ipv4-unicast bgp log-neighbor-changes neighbor 4.4.4.4 remote-as 10000 neighbor 4.4.4.4 update-source Loopback0 ! address-family ipv4 neighbor 4.4.4.4 activate no auto-summary no synchronization exit-address-family ! address-family vpnv4 neighbor 4.4.4.4 activate neighbor 4.4.4.4 send-community extended exit-address-family ! address-family ipv4 vrf CCIE redistribute rip no auto-summary no synchronization exit-address-family ! address-family ipv4 vrf CCDE redistribute ospf 2 vrf CCDE no auto-summary no synchronization exit-address-family ! ip classless ! no ip http server ! ! ! ! ! ! control-plane ! ! dial-peer cor custom ! ! ! ! line con 0 exec-timeout 0 0 logging synchronous stopbits 1 line aux 0 stopbits 1 line vty 0 4 ! ! end R3#

R4#sh run Building configuration... Current configuration : 2627 bytes ! version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname R4 ! boot-start-marker boot-end-marker ! ! ip subnet-zero ip cef ! ! no ip domain-lookup ! ip vrf CCDE rd 444:2 route-target export 1001:11 route-target import 1001:11 ! ip vrf CCIE rd 444:1 route-target export 10001:1 route-target import 10000:1 ! no mpls traffic-eng auto-bw timers frequency 0 call rsvp-sync ! ! ! ! ! ! ! ! interface Loopback0 ip address 4.4.4.4 255.255.255.255 no clns route-cache ! interface FastEthernet0/0 ip vrf forwarding CCIE ip address 1.1.42.4 255.255.255.0 duplex auto speed auto no clns route-cache ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto no clns route-cache ! interface Serial1/0 ip address 1.1.43.4 255.255.255.0 mpls ip serial restart-delay 0 no clns route-cache ! interface Serial1/1 ip address 1.1.45.4 255.255.255.0 mpls ip serial restart-delay 0 no clns route-cache ! interface Serial1/2 no ip address shutdown serial restart-delay 0 no clns route-cache ! interface Serial1/3 no ip address shutdown serial restart-delay 0 no clns route-cache ! interface ATM2/0 no ip address no atm enable-ilmi-trap no clns route-cache ! interface ATM2/0.2 point-to-point ip vrf forwarding CCDE ip address 1.1.48.4 255.255.255.0 no atm enable-ilmi-trap pvc 0/102 encapsulation aal5snap ! ! router eigrp 100 no auto-summary ! address-family ipv4 vrf CCDE redistribute bgp 10000 metric 1 1 1 1 1 network 0.0.0.0 no auto-summary autonomous-system 100 exit-address-family ! router ospf 1 router-id 4.4.4.4 log-adjacency-changes network 1.1.42.4 0.0.0.0 area 0 network 1.1.43.4 0.0.0.0 area 0 network 1.1.45.4 0.0.0.0 area 0 network 4.4.4.4 0.0.0.0 area 0 ! router rip ! address-family ipv4 vrf CCIE redistribute bgp 10000 metric 1 network 1.0.0.0 no auto-summary version 2 exit-address-family ! router bgp 10000 no synchronization bgp log-neighbor-changes neighbor 3.3.3.3 remote-as 10000 neighbor 3.3.3.3 update-source Loopback0 no auto-summary ! address-family vpnv4 neighbor 3.3.3.3 activate neighbor 3.3.3.3 send-community extended exit-address-family ! address-family ipv4 vrf CCIE redistribute rip no auto-summary no synchronization exit-address-family ! address-family ipv4 vrf CCDE redistribute eigrp 100 no auto-summary no synchronization exit-address-family ! ip classless ! no ip http server ! ! ! ! ! ! control-plane ! ! dial-peer cor custom ! ! ! ! line con 0 exec-timeout 0 0 logging synchronous stopbits 1 line aux 0 stopbits 1 line vty 0 4 ! ! end R4#

Please look into the configuration of R3 and R4 (ISP- PE) now you can see I have configured vrf CCIE and CCDE, IGP for PE to CE, IGP for Internal ISP and BGP for distributing customers routes.

Noting to 2 new configuration rd (route distinguisher) and route target, the rd provide a uniq id to the NLRI so the router will know if route 192.168.0.0 of Customer A from 192.168.0.0 of Customer B as it is perfectly ok for me to use RFC1918 range in my organization and have the same range used in 10 other organization’s however if all 10 are connected to the same ISP and the ISP need to provide the customer vpn between his sites, he also need to know that when he get communication from the CEO of Microsoft not to deliver it by mistake to the CEO of Cisco when he only wanted to send the communication to the CTO of Microsoft (although it will simply not going to work in the application level, this is a raw example of what we want to avoid).

 

R4# sh ip bgp vpnv4 all
BGP table version is 58, local router ID is 4.4.4.4
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 333:1
*>i1.1.1.1/32       3.3.3.3                  1    100      0 ?
*>i1.1.13.0/24      3.3.3.3                  0    100      0 ?
Route Distinguisher: 333:2
*>i1.1.67.0/24      3.3.3.3                  0    100      0 ?
*>i6.6.6.6/32       3.3.3.3                 65    100      0 ?
*>i33.3.3.3/32      3.3.3.3                  0    100      0 ?
Route Distinguisher: 444:1 (default for vrf CCIE)
*>i1.1.1.1/32       3.3.3.3                  1    100      0 ?
*>i1.1.13.0/24      3.3.3.3                  0    100      0 ?
*> 1.1.22.2/32      1.1.42.2                 1         32768 ?
*> 1.1.42.0/24      0.0.0.0                  0         32768 ?
*> 2.2.2.2/32       1.1.42.2                 1         32768 ?
Route Distinguisher: 444:2 (default for vrf CCDE)
*> 1.1.48.0/24      0.0.0.0                  0         32768 ?
*>i1.1.67.0/24      3.3.3.3                  0    100      0 ?
*>i6.6.6.6/32       3.3.3.3                 65    100      0 ?
   Network          Next Hop            Metric LocPrf Weight Path
*> 8.8.8.8/32       1.1.48.8            146432         32768 ?
*>i33.3.3.3/32      3.3.3.3                  0    100      0 ?
R4# sh ip bgp vpnv4 all
BGP table version is 62, local router ID is 4.4.4.4
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 333:1
*>i1.1.1.1/32       3.3.3.3                  1    100      0 ?
*>i1.1.13.0/24      3.3.3.3                  0    100      0 ?
*>i192.168.0.0      3.3.3.3                  1    100      0 ?
Route Distinguisher: 333:2
*>i1.1.67.0/24      3.3.3.3                  0    100      0 ?
*>i6.6.6.6/32       3.3.3.3                 65    100      0 ?
*>i33.3.3.3/32      3.3.3.3                  0    100      0 ?
Route Distinguisher: 444:1 (default for vrf CCIE)
*>i1.1.1.1/32       3.3.3.3                  1    100      0 ?
*>i1.1.13.0/24      3.3.3.3                  0    100      0 ?
*> 1.1.22.2/32      1.1.42.2                 1         32768 ?
*> 1.1.42.0/24      0.0.0.0                  0         32768 ?
*> 2.2.2.2/32       1.1.42.2                 1         32768 ?
*>i192.168.0.0      3.3.3.3                  1    100      0 ?
Route Distinguisher: 444:2 (default for vrf CCDE)
*> 1.1.48.0/24      0.0.0.0                  0         32768 ?
   Network          Next Hop            Metric LocPrf Weight Path
*>i1.1.67.0/24      3.3.3.3                  0    100      0 ?
*>i6.6.6.6/32       3.3.3.3                 65    100      0 ?
*> 8.8.8.8/32       1.1.48.8            146432         32768 ?
*>i33.3.3.3/32      3.3.3.3                  0    100      0 ?
*> 192.168.0.0      1.1.48.8            146432         32768 ?

Please notice to route 192.168.0.0

R1_VRF_CCIE#sh run int lo10
Building configuration...
Current configuration : 66 bytes
!
interface Loopback10
 ip address 192.168.0.1 255.255.255.0
end
R2_VRF_CCDE#sh run int lo10
Building configuration...
Current configuration : 87 bytes
!
interface Loopback10
 ip address 192.168.0.1 255.255.255.0
 no clns route-cache
end
R2_VRF_CCDE#

R1_VRF_CCDE#ping 192.168.0.1 r 1
Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 192.168.0.1, timeout is 2 seconds:
!
Success rate is 100 percent (1/1), round-trip min/avg/max = 44/44/44 ms
R1_VRF_CCDE#
R2_VRF_CCDE#debug ip icmp
ICMP packet debugging is on
R2_VRF_CCDE#
01:37:17: ICMP: echo reply sent, src 192.168.0.1, dst 1.1.67.6
R2_VRF_CCIE#ping 192.168.0.1 r 1
Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 192.168.0.1, timeout is 2 seconds:
!
Success rate is 100 percent (1/1), round-trip min/avg/max = 68/68/68 ms
R2_VRF_CCIE#
R1_VRF_CCIE#debug ip icmp
ICMP packet debugging is on
R1_VRF_CCIE#
*Mar  1 01:38:17.739: ICMP: echo reply sent, src 192.168.0.1, dst 1.1.42.2

So that is the power of rd!

Now what is the route target , I will try to explain it in a simple way, between the PE’s we have BGP running, for the IGP routes to be propagated correctly between them I need to tell each vrf what NLRI to import and export from and to the BGP. it should be unique for per customers as the rd is unique.

! R3 Original config
ip vrf CCDE
 rd 333:2
 route-target export 1001:11
 route-target import 1001:11
!
ip vrf CCIE
 rd 333:1
 route-target export 10000:1
 route-target import 10001:1
!
R3(config)#ip vrf CCIE
R3(config-vrf)#route-target import 1001:11
# See what happen on R1 :
R1_VRF_CCIE#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     1.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
C       1.1.1.1/32 is directly connected, Loopback0
C       1.1.13.0/24 is directly connected, FastEthernet0/0
R       1.1.22.2/32 [120/1] via 1.1.13.3, 00:00:24, FastEthernet0/0
R       1.1.42.0/24 [120/1] via 1.1.13.3, 00:00:24, FastEthernet0/0
     2.0.0.0/32 is subnetted, 1 subnets
R       2.2.2.2 [120/1] via 1.1.13.3, 00:00:24, FastEthernet0/0
C    192.168.0.0/24 is directly connected, Loopback10
R1_VRF_CCIE#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     1.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
C       1.1.1.1/32 is directly connected, Loopback0
C       1.1.13.0/24 is directly connected, FastEthernet0/0
R       1.1.22.2/32 [120/1] via 1.1.13.3, 00:00:01, FastEthernet0/0
R       1.1.42.0/24 [120/1] via 1.1.13.3, 00:00:01, FastEthernet0/0
R       1.1.48.0/24 [120/1] via 1.1.13.3, 00:00:01, FastEthernet0/0
R       1.1.67.0/24 [120/1] via 1.1.13.3, 00:00:01, FastEthernet0/0
     2.0.0.0/32 is subnetted, 1 subnets
R       2.2.2.2 [120/1] via 1.1.13.3, 00:00:02, FastEthernet0/0
     33.0.0.0/32 is subnetted, 1 subnets
R       33.3.3.3 [120/1] via 1.1.13.3, 00:00:02, FastEthernet0/0
     6.0.0.0/32 is subnetted, 1 subnets
R       6.6.6.6 [120/1] via 1.1.13.3, 00:00:02, FastEthernet0/0
     8.0.0.0/32 is subnetted, 1 subnets
R       8.8.8.8 [120/1] via 1.1.13.3, 00:00:03, FastEthernet0/0
C    192.168.0.0/24 is directly connected, Loopback10
R1_VRF_CCIE#

by importing CCDE route target I cause a leak and R1 to be aware for routes he do not have any access to

R1_VRF_CCIE#ping 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R1_VRF_CCIE#ping 192.168.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms
# And even worse I have caused comunication to be replayed from the wrong 
# host just because he hold the same IP!!
R2_VRF_CCDE#
02:07:58: ICMP: echo reply sent, src 8.8.8.8, dst 1.1.13.1
02:08:00: ICMP: echo reply sent, src 8.8.8.8, dst 1.1.13.1
02:08:02: ICMP: echo reply sent, src 8.8.8.8, dst 1.1.13.1
02:08:04: ICMP: echo reply sent, src 8.8.8.8, dst 1.1.13.1
02:08:06: ICMP: echo reply sent, src 8.8.8.8, dst 1.1.13.1
 

I hope that was informative, for now providing you basic understanding to what is BGP FREE CORE advantages and what can cause misunderstanding the basics.