LAB 01 / 20

MPLS Core LDP Label Distribution

INTERMEDIATE ⏱ Estimated: 45 min
MPLS LDP OSPF Area 0 BFD Label Range

Build the MPLS core backbone: configure OSPF area 0 with MD5 auth, enable LDP with neighbor authentication and custom label range, add BFD for sub-second failure detection. Verify label distribution end-to-end.

Lab Timer
45:00
CCIE Lab: 8hr total · this lab: 45min
📋 Prerequisites
  • Understand OSPF neighbor states (Init → 2-Way → ExStart → Exchange → Loading → Full)
  • Know IPv4 /31 subnets and point-to-point link addressing
  • Understand MPLS forwarding fundamentals: FIB, LFIB, label swap, PHP
  • Understand LDP session establishment (TCP 646) and label space types
  • Know MD5 authentication for OSPF and LDP
  • Complete: Lab environment has GNS3/EVE-NG with IOS 15.2+ images loaded
🗺 Topology — Active Nodes
01 MPLS CORE LDP MPLS P Routers — LDP Core — Active: CORE-1,CORE-2,CORE-3,CORE-4 See master topology for full 20-router diagram Active Nodes: CORE-1,CORE-2,CORE-3,CORE-4 MPLS P Routers — LDP Core CORE-1,CORE-2,CORE-3,CORE-4 Refer to lab.html for complete step-by-step configuration and verification commands for each active router Active Zone Inactive (dimmed) Ioannis (John) Alexander Konstas
📡 IP Addressing — Pre-configured on Initial Configs
RouterInterfaceIPv4 AddressIPv6 AddressConnected To
CORE-1Lo010.255.1.1/322001:db8:ff:1::1/128LDP Router-ID
CORE-1Gi0/010.0.12.0/312001:db8:0:12::1/64CORE-2 Gi0/0
CORE-1Gi0/110.0.13.0/312001:db8:0:13::1/64CORE-3 Gi0/0
CORE-1Gi0/210.0.101.0/312001:db8:0:101::1/64EDGE-1 Gi0/0
CORE-2Lo010.255.1.2/322001:db8:ff:1::2/128LDP Router-ID
CORE-2Gi0/010.0.12.1/312001:db8:0:12::2/64CORE-1 Gi0/0
CORE-2Gi0/110.0.24.0/312001:db8:0:24::2/64CORE-4 Gi0/0
CORE-3Lo010.255.1.3/322001:db8:ff:1::3/128LDP Router-ID
CORE-3Gi0/010.0.13.1/312001:db8:0:13::3/64CORE-1 Gi0/1
CORE-3Gi0/110.0.34.0/312001:db8:0:34::3/64CORE-4 Gi0/1
CORE-4Lo010.255.1.4/322001:db8:ff:1::4/128LDP Router-ID
CORE-4Gi0/010.0.24.1/312001:db8:0:24::4/64CORE-2 Gi0/1
CORE-4Gi0/110.0.34.1/312001:db8:0:34::4/64CORE-3 Gi0/1
📝 Task Sheet
Lab 01 — MPLS Core LDP Tasks Check tasks as you complete them
TASK 1 Configure OSPF Area 0 on All CORE Routers EASY
  1. Enable OSPF process 1 on CORE-1, CORE-2, CORE-3, CORE-4. Use each router's Loopback0 IP as the router-ID (e.g., CORE-1: router-id 10.255.1.1).
  2. Advertise all Loopback0 addresses into OSPF area 0 as host routes (/32).
  3. Advertise all P2P backbone links (10.0.12.0/31, 10.0.13.0/31, 10.0.24.0/31, 10.0.34.0/31) into OSPF area 0.
  4. Set all P2P interfaces as ip ospf network point-to-point to eliminate DR/BDR election.
  5. Set Loopback0 as passive-interface on all routers (prevent OSPF hellos on loopbacks).
Verify Task 1: Run show ip ospf neighbor on CORE-1. You must see CORE-2 and CORE-3 in FULL state. If any neighbor shows Init or 2-Way, check network statements and passive-interface settings.
TASK 2 Enable OSPF MD5 Authentication on All Backbone Interfaces MEDIUM
  1. Configure area-wide MD5 authentication under OSPF process 1: area 0 authentication message-digest on all CORE routers.
  2. On each backbone interface, set: ip ospf message-digest-key 7 md5 Nx9#mP2@qK. Key ID must be 7 on all routers — mismatched key IDs cause adjacency failure.
  3. Verify adjacencies reform after authentication is enabled. OSPF should drop and re-establish all neighbors within 40 seconds (dead interval × 4).
Verify Task 2: Run show ip ospf interface GigabitEthernet0/0 and confirm: "Message digest authentication enabled" with "Key ID 7". Run show ip ospf neighbor — all neighbors must be FULL again.
TASK 3 Enable MPLS LDP on All CORE Routers MEDIUM
  1. Set the global MPLS label range: mpls label range 1000 9999 on all CORE routers. This prevents label collisions with other MPLS applications.
  2. Force LDP to use Loopback0 as transport address: mpls ldp router-id Loopback0 force. The "force" keyword overrides any existing LDP sessions immediately.
  3. Enable LDP autoconfig under OSPF: mpls ldp autoconfig area 0 inside router ospf 1. This enables LDP on all interfaces in OSPF area 0 automatically.
  4. Verify LDP discovers peers by checking show mpls ldp discovery — all backbone interfaces should appear.
Verify Task 3: Run show mpls ldp neighbor. You must see all adjacent P router loopbacks in Oper state. The "Transport" address should be the loopback (10.255.1.x), NOT a physical interface.
TASK 4 Configure LDP MD5 Neighbor Authentication HARD
  1. On CORE-1, configure LDP password for each adjacent P router: mpls ldp neighbor 10.255.1.2 password Fp6&kN3@sX and mpls ldp neighbor 10.255.1.3 password Fp6&kN3@sX.
  2. Apply matching passwords on ALL peer routers (CORE-2 toward CORE-1 and CORE-4; CORE-3 toward CORE-1 and CORE-4; CORE-4 toward CORE-2 and CORE-3). LDP authentication is bidirectional — both sides must match.
  3. After authentication is configured, verify LDP sessions drop and re-establish (TCP connection reset on port 646). This may take 15–30 seconds.
Verify Task 4: Run show mpls ldp neighbor detail and confirm "TCP MD5 auth: enabled" appears for each session. If a session stays in "Non Existent" or "Initialized" state, check that passwords match exactly on both peers.
TASK 5 Configure BFD for Sub-Second OSPF Failure Detection HARD
  1. On each backbone interface of all CORE routers, enable BFD: bfd interval 300 min_rx 300 multiplier 3. This gives 900ms detection (300ms × 3 missed packets).
  2. Enable BFD for OSPF globally: bfd all-interfaces under router ospf 1. OSPF will now use BFD instead of hello/dead timers for failure detection.
  3. Also add ip ospf bfd directly on each backbone interface as a backup method.
Verify Task 5: Run show bfd neighbors. All sessions must show St=Up and Diag=No Diagnostic. Run show ip ospf interface Gi0/0 and confirm BFD is shown as "enabled". Failure detection is now <1 second instead of 40 seconds.
TASK 6 Verify End-to-End Label Switched Path EXPERT
  1. From CORE-1, run show mpls forwarding-table and verify labels are assigned for CORE-4's loopback (10.255.1.4/32). The "Outgoing label" should NOT be "Untagged" for transit paths.
  2. Run traceroute mpls ipv4 10.255.1.4/32 origin 10.255.1.1 from CORE-1. Verify MPLS LSP trace succeeds and shows label stack at each hop.
  3. Check PHP (Penultimate Hop Popping): the router directly connected to CORE-4 (e.g., CORE-2 or CORE-3) should show "Pop Tag" as the outgoing label for 10.255.1.4/32. This is correct behavior — do NOT change it.
  4. Verify label range: run show mpls label range on any CORE router. Should show "Configured range: 1000-9999 Static range: none".
Verify Task 6 (PASS/FAIL Criteria): PASS = traceroute mpls shows "! ! ! ! !" (5 successes), all OSPF neighbors FULL, all LDP sessions Oper with MD5, BFD Up on all sessions, label range 1000–9999 confirmed. Any deviation = FAIL — check troubleshooting below.
✅ Verification Commands with Expected Output
show ip ospf neighbor
CORE-1# show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.255.1.2 0 FULL/ - 00:00:35 10.0.12.1 GigabitEthernet0/0 10.255.1.3 0 FULL/ - 00:00:38 10.0.13.1 GigabitEthernet0/1
State must be FULL/- (hyphen = no DR/BDR = point-to-point network type is correct)
show mpls ldp neighbor
CORE-1# show mpls ldp neighbor Peer LDP Ident: 10.255.1.2:0; Local LDP Ident 10.255.1.1:0 TCP connection: 10.255.1.2.28312 - 10.255.1.1.646 State: Oper; Msgs sent/rcvd: 52/51; Downstream Up time: 00:15:32 LDP discovery sources: GigabitEthernet0/0, Src IP addr: 10.0.12.1 Addresses bound to peer LDP Ident: 10.0.12.1 10.0.24.0 10.255.1.2
State MUST be "Oper". TCP MD5 auth enabled = look for "TCP MD5" in detailed output
show mpls forwarding-table 10.255.1.4/32 detail
CORE-1# show mpls forwarding-table 10.255.1.4/32 detail Local Outgoing Prefix Bytes Label Outgoing Next Hop Label Label or Tunnel Id Switched interface 1025 1048 10.255.1.4/32 0 Gi0/0 10.0.12.1 MAC/Encaps=14/18, MRU=1500, Label Stack{1048} GigabitEthernet0/0, Next Hop 10.0.12.1
Both local and outgoing labels must be in range 1000–9999. "Bytes Label Switched" will increment as traffic flows.
show bfd neighbors
CORE-1# show bfd neighbors NeighAddr LD/RD RH/RS State Int 10.0.12.1 4097/4097 Up Up Gi0/0 10.0.13.1 4098/4098 Up Up Gi0/1
State=Up required. If Down, check bfd interval matching on both sides and that ip ospf bfd is on the interface.
traceroute mpls ipv4 10.255.1.4/32
CORE-1# traceroute mpls ipv4 10.255.1.4/32 Tracing MPLS Label Switched Path to 10.255.1.4/32, timeout is 2 seconds Codes: '!' success, 'Q' request not sent, '.' timeout, 'L' labeled output interface, 'B' unlabeled output interface, 'D' DS Map mismatch, 'F' no FEC mapping, 'f' FEC mismatch Type escape sequence to abort. 0 10.0.12.0 MRU 1500 [Labels: 1048 Exp: 0] L 1 10.0.12.1 MRU 1500 [Labels: implicit-null Exp: 0] 1 ms ! 2 10.0.24.1 1 ms
"!" at final hop = MPLS LSP complete. "L" = labeled forwarding at intermediate hop. PHP visible at penultimate hop (implicit-null).
💡 Key Concepts

LDP Router-ID and Transport Address

The LDP Router-ID determines the LDP Identifier (RouterID:0 for platform-wide label space). More importantly, it sets the transport address — the IP used to establish the TCP-646 session between LDP peers. Without force, the router may choose a physical interface address, which can cause session flaps if that interface goes down. Using Loopback0 force anchors LDP to the stable loopback. Both peers must be able to reach each other's LDP transport address via the IP routing table — which OSPF provides via the loopback advertisements.

LDP Autoconfig vs Manual Interface Configuration

Without mpls ldp autoconfig area 0, you must add mpls ip to each interface individually. Autoconfig automatically enables LDP on every interface participating in the specified OSPF area. This is preferred in production because adding a new link to OSPF area 0 automatically gets LDP — you cannot forget. However, be careful: if you have an interface in OSPF area 0 that should NOT run MPLS (e.g., a management link), you must explicitly exclude it with no mpls ip on that interface after autoconfig enables it.

PHP — Penultimate Hop Popping

PHP occurs when the penultimate (second-to-last) router on an LSP pops the label before forwarding to the final router. The final router (egress PE or CORE router) advertises the "implicit-null" label (3) for its own prefixes, signaling to the penultimate hop: "pop the label and send me native IP." This saves one lookup at the egress — it does not need to check the LFIB. You will see "Pop Tag" or "implicit-null" as the outgoing label at the penultimate hop in show mpls forwarding-table. This is correct — do NOT configure no mpls ip propagate-ttl unless specifically required.

🔧 Troubleshooting — Common Mistakes

Problem: LDP session stays in "Non Existent" after authentication

Cause: Password mismatch — one side has authentication configured, the other does not, OR key strings differ (case-sensitive). LDP drops the TCP session immediately on auth failure. Check with debug mpls ldp transport events — you'll see "MD5 authentication check failed".

Fix: Verify exact password string (case-sensitive) on both peers with show run | include ldp neighbor. Remove and re-add if unsure. LDP will auto-reconnect within 15 seconds.

Problem: OSPF neighbors drop after enabling MD5 authentication

Cause: Authentication was enabled on the area but the key is not configured on one or more interfaces, OR different key IDs are used on the two ends of a link. Key ID 7 on one side and key ID 1 on the other = OSPF drops the neighbor. Check: show ip ospf interface Gi0/0 — it shows the key IDs in use.

Fix: Ensure key-id 7 and exact same key-string on BOTH interfaces of each link. Run clear ip ospf process after fixing to force re-establishment. The neighbor should reform within 40 seconds.

Problem: MPLS labels assigned are outside 1000–9999 range

Cause: mpls label range 1000 9999 was configured AFTER LDP sessions were already established. The router continues using previously assigned labels until sessions are cleared.

Fix: After configuring the label range, run clear mpls ldp neighbor * to force all LDP sessions to reset and re-negotiate labels within the new range. Verify with show mpls label range and show mpls forwarding-table.
🔑 Solution Configurations
Solution Hidden

Try completing the tasks first. Only reveal when truly stuck or to verify your work after completion.
Type SOLUTION below to unlock the full configurations.

✓ Solution revealed. Compare your config with these — differences indicate learning opportunities, not just errors.
CORE-1 P Router · RR · LDP 10.255.1.1/32 
mpls label range 1000 9999
mpls ldp router-id Loopback0 force
mpls ldp neighbor 10.255.1.2 password Fp6&kN3@sX
mpls ldp neighbor 10.255.1.3 password Fp6&kN3@sX

interface GigabitEthernet0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 7 md5 Nx9#mP2@qK
 ip ospf network point-to-point
 ip ospf bfd
 mpls ip
 bfd interval 300 min_rx 300 multiplier 3

interface GigabitEthernet0/1
 ip ospf authentication message-digest
 ip ospf message-digest-key 7 md5 Nx9#mP2@qK
 ip ospf network point-to-point
 ip ospf bfd
 mpls ip
 bfd interval 300 min_rx 300 multiplier 3

interface GigabitEthernet0/2
 ip ospf authentication message-digest
 ip ospf message-digest-key 7 md5 Nx9#mP2@qK
 ip ospf network point-to-point
 ip ospf bfd
 mpls ip
 bfd interval 300 min_rx 300 multiplier 3

router ospf 1
 router-id 10.255.1.1
 area 0 authentication message-digest
 passive-interface Loopback0
 network 10.255.1.1 0.0.0.0 area 0
 network 10.0.12.0 0.0.0.1 area 0
 network 10.0.13.0 0.0.0.1 area 0
 network 10.0.101.0 0.0.0.1 area 0
 mpls ldp autoconfig area 0
 bfd all-interfaces
CORE-2 P Router · RR · LDP 10.255.1.2/32 
mpls label range 1000 9999
mpls ldp router-id Loopback0 force
mpls ldp neighbor 10.255.1.1 password Fp6&kN3@sX
mpls ldp neighbor 10.255.1.4 password Fp6&kN3@sX

interface GigabitEthernet0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 7 md5 Nx9#mP2@qK
 ip ospf network point-to-point
 ip ospf bfd
 mpls ip
 bfd interval 300 min_rx 300 multiplier 3

interface GigabitEthernet0/1
 ip ospf authentication message-digest
 ip ospf message-digest-key 7 md5 Nx9#mP2@qK
 ip ospf network point-to-point
 ip ospf bfd
 mpls ip
 bfd interval 300 min_rx 300 multiplier 3

interface GigabitEthernet0/2
 ip ospf authentication message-digest
 ip ospf message-digest-key 7 md5 Nx9#mP2@qK
 ip ospf network point-to-point
 ip ospf bfd
 mpls ip
 bfd interval 300 min_rx 300 multiplier 3

router ospf 1
 router-id 10.255.1.2
 area 0 authentication message-digest
 passive-interface Loopback0
 network 10.255.1.2 0.0.0.0 area 0
 network 10.0.12.0 0.0.0.1 area 0
 network 10.0.24.0 0.0.0.1 area 0
 network 10.0.102.0 0.0.0.1 area 0
 mpls ldp autoconfig area 0
 bfd all-interfaces
CORE-3 / CORE-4 P Routers — same pattern, different neighbors 
! CORE-3 specific:
mpls ldp neighbor 10.255.1.1 password Fp6&kN3@sX
mpls ldp neighbor 10.255.1.4 password Fp6&kN3@sX

router ospf 1
 router-id 10.255.1.3   ! (or 10.255.1.4 for CORE-4)
 area 0 authentication message-digest
 network 10.255.1.3 0.0.0.0 area 0   ! adjust per router
 network 10.0.13.0 0.0.0.1 area 0    ! adjust per router
 network 10.0.34.0 0.0.0.1 area 0
 mpls ldp autoconfig area 0
 bfd all-interfaces

! CORE-4 neighbors:
! mpls ldp neighbor 10.255.1.2 password Fp6&kN3@sX
! mpls ldp neighbor 10.255.1.3 password Fp6&kN3@sX
Initial Configs — Load These First
⬇ CORE-1-initial.cfg ⬇ CORE-2-initial.cfg ⬇ CORE-3-initial.cfg ⬇ CORE-4-initial.cfg
↓ CORE-1.cfg ↓ CORE-2.cfg ↓ CORE-3.cfg ↓ CORE-4.cfg

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.