EDU-JUN-JMV lab on vMX. Part1.

This time I'm going to continue my experiments with Juniper virtualMX I've started in this getting started post 

It was written in Russian, but contains enough pictures and CLI issues which describe themselves.

Now I'll cover how to set up Junos MPLS and VPN's labs with vMX. That may be useful for companies with a low education budget as a way to spread knowledge among staff.

Objective

I intend to solve two main tasks. Firstly, I have to deploy an appropriate topology in a virtual environment and accomplish two basic labs: Lab-1 and Lab-6 so as to prepare baseline configurations used in the rest of labs. Secondly, I must see that it works :) thus I will perform Lab-12 LDP based VPLS - my beloved technology.

Physical topology. Almost physical)

Let's take a diagram from site provides Juniper labs for rent and make something similar.

It will take two vMX - vr1 and vr2 for the core network and a couple vMX as two PE routers called mx_-y.  P1 and P4 would be default routers but P2,3,5,6 are logical-systems on the same vr's  respectively. I use logical-systems because they can support mpls encapsulations. All client`s devices are virtual-instances on PE routers.
Only one problem is numbering of interfaces which don't match with those in the lab-guide. In red colour virbr instances are marked. They connect router's interface with KVM and through it - with another interface. 17 of them are needed and it is important to point mac addresses both in virbr configuration xml file and in interface container on virtual router.

Before we start

I've downloaded newer image from pan.baidu.com  jinstall-vmx-14.1R4.8-domestic.img I still do not understand is it a beta version or it stops working in 30 days. I would appreciate if somebody explained this. This image requires separate VM for forwarding, however we can enable built-in one and save some RAM

root@% clear
root@% echo 'vm_local_rpio="1"' >> /boot/loader.conf
root@% grep rpio /boot/loader.conf
vm_local_rpio="1"
root@% reboot

There was one incident of losing connection with rpio. Restart chassis-control  command helps.
A number of important question about making connection to vMX from an external world, configuration backup and access control I will describe in the next post.

Lab 12. LDP VPLS

Configure all mx_-1,2 devices according to the lab-guide with amendments to the other interface numbers. On vr-device we configure basic ip connectivity and mpls\ldp\rsvp protocols and encapsulations. Configurations are presented below.

The most amazing thing is that it works! We can ping client router from another one and see some vpls statistics.

lab@m1A-2> show vpls connections
Instance: vpn-1
  VPLS-id: 100
    Neighbor                  Type  St     Time last up          # Up trans
    192.168.1.1(vpls-id 100)  rmt   Up     Jan 28 19:14:50 2016           1
      Remote PE: 192.168.1.1, Negotiated control-word: No
      Incoming label: 800000, Outgoing label: 800001
      Negotiated PW status TLV: No
      Local interface: vt-0/0/10.1048576, Status: Up, Encapsulation: ETHERNET
        Description: Intf - vpls vpn-1 neighbor 192.168.1.1 vpls-id 100
      Flow Label Transmit: No, Flow Label Receive: No

lab@m1A-1> ping 10.0.10.2 routing-instance c-router1-1 count 3
PING 10.0.10.2 (10.0.10.2): 56 data bytes
64 bytes from 10.0.10.2: icmp_seq=0 ttl=64 time=26.595 ms
64 bytes from 10.0.10.2: icmp_seq=1 ttl=64 time=11.398 ms
64 bytes from 10.0.10.2: icmp_seq=2 ttl=64 time=12.120 ms

--- 10.0.10.2 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/stddev = 11.398/16.704/26.595/7.000 ms

lab@m1A-1> show vpls statistics
VPLS statistics:

Instance: vpn-1
   Local interface: ge-0/0/4.610, Index: 346
     Broadcast packets:                     2
     Broadcast bytes  :                   120
     Multicast packets:                     0
     Multicast bytes  :                     0
     Flooded packets  :                     0
     Flooded bytes    :                     0
     Unicast packets  :                     3
     Unicast bytes    :                   306
     Current MAC count:                     1 (Limit 1024)
   Local interface: vt-0/0/10.1048576, Index: 349
   Remote PE: 192.168.1.2
     Broadcast packets:                     1
     Broadcast bytes  :                    60
     Multicast packets:                     0
     Multicast bytes  :                     0
     Flooded packets  :                     0
     Flooded bytes    :                     0
     Unicast packets  :                     4
     Unicast bytes    :                   366
     Current MAC count:                     1

lab@m1A-1> show vpls mac-table

MAC flags       (S -static MAC, D -dynamic MAC, L -locally learned, C -Control MAC
    O -OVSDB MAC, SE -Statistics enabled, NM -Non configured MAC, R -Remote PE MAC)

Routing instance : vpn-1
 Bridging domain : __vpn-1__, VLAN : NA
   MAC                 MAC      Logical          NH     RTR
   address             flags    interface        Index  ID
   52:54:02:01:00:06   D        ge-0/0/4.610
   56:54:02:01:00:06   D        vt-0/0/10.1048576

vr1 router config file

## Last commit: 2016-01-28 12:23:22 UTC by admin
version 14.1R4.8;
system {
    host-name p1;
    root-authentication {
        encrypted-password "$itsrealysecretV."; ## SECRET-DATA
    }
    login {
        user admin {
            uid 1001;
            class super-user;
            authentication {
                encrypted-password "teretteretet"; ## SECRET-DATA
            }
        }
        user lab {
            uid 1002;
            class operator;
            authentication {
                encrypted-password "$1$5BqqHpkr$3eo84Lnm7BhjcNXY5DPBm0"; ## SECRET-DATA
            }
        }
    }
    services {
        ssh {
            rate-limit 15;
        }
    }
    syslog {
        user * {
            any emergency;
        }
        file messages {
            any notice;
            authorization info;
        }
        file interactive-commands {
            interactive-commands any;
        }
    }
}
logical-systems {
    p2 {
        interfaces {
            ge-0/0/3 {
                unit 0 {
                    family inet {
                        address 172.22.201.2/24;
                    }
                    family mpls;
                }
            }
            ge-0/0/5 {
                unit 0 {
                    family inet {
                        address 172.22.206.1/24;
                    }
                    family mpls;
                }
            }
            lo0 {
                unit 2 {
                    family inet {
                        address 192.168.5.2/32;
                    }
                }
            }
        }
        protocols {
            mpls {
                static-label-switched-path lsp-1-2 {
                    transit 1000111 {
                        next-hop 172.22.206.2;
                        swap 1000121;
                    }
                }
                static-label-switched-path lsp-2-1 {
                    transit 1000132 {
                        next-hop 172.22.201.1;
                        swap 1000122;
                    }
                }
                interface all;
            }
            ospf {
                area 0.0.0.0 {
                    interface ge-0/0/3.0;
                    interface ge-0/0/5.0;
                    interface lo0.2;
                }
            }
            ldp {
                interface all;
            }
        }
    }
    p3 {
        interfaces {
            ge-0/0/6 {
                unit 0 {
                    family inet {
                        address 172.22.206.2/24;
                    }
                    family mpls;
                }
            }
            ge-0/0/8 {
                unit 212 {
                    vlan-id 212;
                    family inet {
                        address 172.22.212.2/24;
                    }
                    family mpls;
                }
            }
            lo0 {
                unit 3 {
                    family inet {
                        address 192.168.5.3/32;
                    }
                }
            }
        }
        protocols {
            mpls {
                static-label-switched-path lsp-1-2 {
                    transit 1000121 {
                        next-hop 172.22.212.1;
                        pop;
                    }
                }
                static-label-switched-path lsp-2-1 {
                    transit 1000102 {
                        next-hop 172.22.206.1;
                        swap 1000132;
                    }
                }
                interface all;
            }
            ospf {
                area 0.0.0.0 {
                    interface ge-0/0/6.0;
                    interface ge-0/0/8.212;
                    interface lo0.3;
                }
            }
            ldp {
                interface all;
            }
        }
    }
}
interfaces {
    ge-0/0/0 {
        vlan-tagging;
        mac 58:54:02:01:00:00;
        unit 210 {
            vlan-id 210;
            family inet {
                address 172.22.210.2/24;
            }
            family mpls;
        }
    }
    ge-0/0/1 {
        mac 58:54:02:01:00:01;
    }
    ge-0/0/2 {
        mac 58:54:02:01:00:02;
        unit 0 {
            family inet {
                address 172.22.201.1/24;
            }
            family mpls;
        }
    }
    ge-0/0/3 {
        mac 58:54:02:01:00:03;
    }
    ge-0/0/4 {
        mac 58:54:02:01:00:04;
    }
    ge-0/0/5 {
        mac 58:54:02:01:00:05;
    }
    ge-0/0/6 {
        mac 58:54:02:01:00:06;
    }
    ge-0/0/7 {
        mac 58:54:02:01:00:07;
    }
    ge-0/0/8 {
        vlan-tagging;
        mac 58:54:02:01:00:08;
    }
    em0 {
        mac 58:54:02:01:00:11;
        unit 0 {
            family inet {
                address 192.168.122.5/24;
            }
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 192.168.5.1/32;
            }
        }
    }
}
protocols {
    mpls {
        static-label-switched-path lsp-1-2 {
            transit 1000101 {
                next-hop 172.22.201.2;
                swap 1000111;
            }
        }
        static-label-switched-path lsp-2-1 {
            transit 1000122 {
                next-hop 172.22.210.1;
                pop;
            }
        }
        interface all;
        interface em0.0 {
            disable;
        }
    }
    ospf {
        area 0.0.0.0 {
            interface ge-0/0/0.210;
            interface ge-0/0/2.0;
            interface lo0.0;
        }
    }
    ldp {
        interface all;
        interface em0.0 {
            disable;
        }
    }
}

m1A-1 router config file

## Last commit: 2016-01-28 19:24:42 UTC by lab
version 14.1R4.8;
system {
    host-name m1A-1;
    root-authentication {
        encrypted-password "$stillsecret7."; ## SECRET-DATA
    }
    login {
        user lab {
            uid 1001;
            class super-user;
            authentication {
                encrypted-password "$1$GZJeImZL$ELhFH8nxuuK0elUJ6ZDcE/"; ## SECRET-DATA
            }
        }
    }
    services {
        ssh {
            rate-limit 15;
        }
    }
    syslog {
        user * {
            any emergency;
        }
        file messages {
            any notice;
            authorization info;
        }
        file interactive-commands {
            interactive-commands any;
        }
    }
}
chassis {
    fpc 0 {
        pic 0 {
            tunnel-services {
                bandwidth 1g;
            }
        }
    }
}
interfaces {
    ge-0/0/0 {
        vlan-tagging;
        mac 52:54:02:01:00:03;
        unit 210 {
            vlan-id 210;
            family inet {
                address 172.22.210.1/24;
            }
            family mpls;
        }
    }
    ge-0/0/1 {
        vlan-tagging;
        mac 52:54:02:01:00:04;
        unit 211 {
            vlan-id 211;
            family inet {
                address 172.22.211.1/24;
            }
            family mpls;
        }
    }
    ge-0/0/2 {
        vlan-tagging;
        encapsulation flexible-ethernet-services;
        mac 52:54:02:01:00:05;
        unit 610 {
            encapsulation vlan-bridge;
            vlan-id 610;
        }
    }
    ge-0/0/3 {
        vlan-tagging;
        mac 52:54:02:01:00:06;
        unit 610 {
            vlan-id 610;
            family inet {
                address 10.0.10.1/24;
            }
        }
    }
    ge-0/0/4 {
        vlan-tagging;
        encapsulation vlan-vpls;
        mac 52:54:02:01:00:08;
        unit 610 {
            encapsulation vlan-vpls;
            vlan-id 610;
        }
    }
    ge-0/0/5 {
        vlan-tagging;
        encapsulation flexible-ethernet-services;
        mac 52:54:02:01:00:09;
        unit 610 {
            encapsulation vlan-bridge;
            vlan-id 610;
        }
    }
    ge-0/0/6 {
        mac 52:54:02:01:00:10;
    }
    ge-0/0/7 {
        vlan-tagging;
        encapsulation flexible-ethernet-services;
        mac 52:54:02:01:00:11;
        unit 610 {
            encapsulation vlan-bridge;
            vlan-id 610;
        }
    }
    em0 {
        mac 52:54:02:01:00:01;
        unit 0 {
            family inet {
                address 192.168.122.2/24;
            }
        }
    }
    lo0 {
        unit 0 {
            family inet {
                address 192.168.1.1/32;
            }
        }
        unit 1 {
            family inet {
                address 192.168.11.1/32;
            }
        }
    }
}
routing-options {
    route-distinguisher-id 192.168.1.1;
    autonomous-system 65512;
}
protocols {
    rsvp {
        interface all;
        interface em0.0 {
            disable;
        }
    }
    mpls {
        inactive: static-label-switched-path lsp-1-2 {
            ingress {
                next-hop 172.22.210.2;
                to 192.168.1.2;
                push 1000101;
            }
        }
        interface all;
        interface em0.0 {
            disable;
        }
    }
    bgp {
        group my-int-group {
            type internal;
            local-address 192.168.1.1;
            family inet {
                unicast;
            }
            family inet-vpn {
                unicast;
            }
            export nhs;
            neighbor 192.168.1.2;
        }
        group my-ext-grou {
            type external;
            peer-as 65101;
            neighbor 10.0.10.2;
        }
    }
    ospf {
        traffic-engineering;
        area 0.0.0.0 {
            interface ge-0/0/0.210;
            interface ge-0/0/1.211;
            interface lo0.0;
        }
    }
    ldp {
        interface all;
        interface em0.0 {
            disable;
        }
    }
}
policy-options {
    policy-statement ce-exp-loop {
        term 1 {
            from {
                protocol direct;
                route-filter 192.168.11.1/32 exact;
            }
            then accept;
        }
    }
    policy-statement exp-policy {
        term 10 {
            from protocol static;
            then accept;
        }
        term 20 {
            from protocol direct;
            then accept;
        }
    }
    policy-statement nhs {
        term 1 {
            from protocol bgp;
            then {
                next-hop self;
                accept;
            }
        }
    }
}
routing-instances {
    c-router1-1 {
        instance-type virtual-router;
        interface ge-0/0/3.610;
        interface lo0.1;
        routing-options {
            static {
                route 172.10.0.0/24 reject;
                route 172.10.1.0/24 reject;
                route 172.10.2.0/24 reject;
                route 172.10.3.0/24 reject;
            }
        }
    }
    ce-vs1-1 {
        instance-type virtual-switch;
        bridge-domains {
            vlan_610 {
                vlan-id 610;
                interface ge-0/0/2.610;
                interface ge-0/0/5.610;
                interface ge-0/0/7.610;
            }
        }
    }
    vpn-1 {
        instance-type vpls;
        interface ge-0/0/4.610;
        protocols {
            vpls {
                vpls-id 100;
                neighbor 192.168.1.2;
            }
        }
    }
}

Questions

I'm still not sure that my lab won't turn into a pumpkin in 30 days after trial period expiration. Can all technologies mentioned in Junos MPLS and VPNs training work on the stand that I've deployed?