Re: MPLS vpnv4 - Hiding IPs in traceroute.

Jack,

I do not think so (or at least the way you might be thinking). Then command
"no mpls pro.. ttl" is working within the MPLS lable's. On the PE router
interface that has the CE connected to it is not a MPLS interface (more
typically a VRF VPN interface) . If you really wanted to stop this the
only way I can think of doing it is an ACL on the PE routers denying all
ICMP unreachables & time exceded in bound from the CE router.

HTH
Chris

On Mon, Jan 11, 2010 at 3:55 PM, Jack Router <pan.router_at_gmail.com> wrote:

> Hello all.
>
> I have a question regarding ttl propagation in mpls. This is the topology:
>
> Host1 -- R1(CE) -- R2(PE) -- R3(P) -- R4(P) -- R5(PE) -- R6(CE) -- Host2
>
> MPLS runs on PE and P routers (R2, R3, R4, R5)
> OSPF runs on PE and P routers (R2, R3, R4, R5)
> MP-BGP runs on PE routers (R2 and R5)
> RIP runs on PE and CE routers (R1, R2 and R5, R6)
> MPLS ldp, VPNv4, VRFs etc configured and appear to be working correctly as
> I
> have connectivity across the cloud.
>
> Ping from Host1 to Host2 with "mpls ip propagate-ttl forwarded" (default
> setting):
> Host1#trace 172.16.51.12
> 1 172.16.50.1 12 msec 52 msec 64 msec
> 2 10.1.12.2 112 msec 104 msec 48 msec
> 3 10.1.23.3 [MPLS: Labels 300/510 Exp 0] 220 msec 348 msec 296 msec
> 4 10.1.24.4 [MPLS: Labels 405/510 Exp 0] 332 msec 312 msec 244 msec
> 5 10.1.56.5 [MPLS: Label 510 Exp 0] 176 msec 212 msec 232 msec
> 6 10.1.56.6 304 msec 228 msec 288 msec
> 7 172.16.51.12 272 msec * 308 msec
>
> Ping from Host1 to Host2 with "NO mpls ip propagate-ttl forwarded" on ALL
> mpls routers (PE and P):
> Host1#trace 172.16.51.12
> 1 172.16.50.1 28 msec 56 msec 56 msec
> 2 10.1.12.2 56 msec 52 msec 52 msec
> 3 10.1.56.5 [MPLS: Label 510 Exp 0] 172 msec 212 msec 164 msec
> 4 10.1.56.6 320 msec 228 msec 324 msec
> 5 172.16.51.12 300 msec * 364 msec
>
> The question is why I see MPLS Label information from R5 (PE router, egress
> interface 10.1.56.5, line #3) even if mpls ttl is disabled? Is this normal?
> Is it possible to configure the network so only CE routers will be visible
> in the trace ?
>
> Thanks,
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html

Blogs and organic groups at http://www.ccie.net
Received on Mon Jan 11 2010 - 16:07:42 ART