IPWorld: August 2019

Topology

Topology Description

· Total six customer sites are connected with three PE routers.

· Each PE router is connected with 2 customer sites.

· PE1 is connected with two customer sites, customer RED CE1, customer BLUE CE1.

· PE2 is connected with two customer sites, customer RED CE2, customer GREEN CE1.

· PE3 also connected with two customer sites that are customer GREEN CE2, and customer BLUE CE2.

· The OSPF is configured to share the loopbacks of all PE and P routers

· For MPLS LSP signaling the RSVP protocol is used

· Bidirectional LSP is established between all the PE routers

· MP-BGP peering is also configured between all three PE routers loopback addresses

o MP-BGP sessions between PE routers require VPN-IPv4 NLRI (family inet-vpn)

· Route Distinguisher is used to distinguish the route between different customer in service provider network. Note that with route distinguisher it is possible to use customers over lapping IP schemes

· VRF import and export policies are used to import and export customer routes in and from customer VRF tables.

· VRF export policy tags the customer route and export it to other PE routers.

· VRF import policy compare the route tag and accept/install customer route in customer’s VRF route table only if the customer tag matched successfully.

· As we are using ethernet interfaces for PE-CE connectivity we use the vrf-table-label.

· Finally, EBGP connectivity is establish between the PE and CE routers. As customer using the same Autonomous System number the as-override also require.

Objectives

Establish Layer3 VPN between PE1 and PE2 for RED customer connectivity
Establish Layer3 VPN between PE1 and PE3 for BLUE customer connectivity
Establish Layer3 VPN between PE2 and PE3 for GREEN customer connectivity

Configurations

PE-1

set system host-name PE-1

set interfaces ge-0/0/6 unit 0 family inet address 30.30.30.1/24

set interfaces ge-0/0/7 unit 0 family inet address 10.10.10.1/24

set interfaces ge-0/0/8 unit 0 family inet address 172.22.211.1/24

set interfaces ge-0/0/8 unit 0 family mpls

set interfaces ge-0/0/9 unit 0 family inet address 172.22.210.1/24

set interfaces ge-0/0/9 unit 0 family mpls

set interfaces lo0 unit 0 family inet address 192.168.100.1/32

set routing-options autonomous-system 65512

set protocols rsvp interface ge-0/0/8.0

set protocols rsvp interface ge-0/0/9.0

set protocols mpls no-cspf

set protocols mpls label-switched-path pe1-to-pe2 from 192.168.100.1

set protocols mpls label-switched-path pe1-to-pe2 to 192.168.100.2

set protocols mpls label-switched-path pe1-to-pe3 from 192.168.100.1

set protocols mpls label-switched-path pe1-to-pe3 to 192.168.100.3

set protocols mpls interface ge-0/0/8.0

set protocols mpls interface ge-0/0/9.0

set protocols bgp group IBGP-PE1 type internal

set protocols bgp group IBGP-PE1 local-address 192.168.100.1

set protocols bgp group IBGP-PE1 family inet unicast

set protocols bgp group IBGP-PE1 family inet-vpn unicast

set protocols bgp group IBGP-PE1 neighbor 192.168.100.2

set protocols bgp group IBGP-PE1 neighbor 192.168.100.3

set protocols ospf area 0.0.0.0 interface ge-0/0/9.0

set protocols ospf area 0.0.0.0 interface ge-0/0/8.0

set protocols ospf area 0.0.0.0 interface lo0.0 passive

root@PE-1# show routing-instances
VPN-BLUE {
    instance-type vrf;
    interface ge-0/0/6.0;
    route-distinguisher 192.168.100.1:2;
    vrf-import import-blue;
    vrf-export export-blue;
    vrf-table-label;
    protocols {
        bgp {
            group EBGP-BLUE-CE1 {
                type external;
                peer-as 65002;
                as-override;
                neighbor 30.30.30.2;
            }
        }
    }
}
VPN-RED {
    instance-type vrf;
    interface ge-0/0/7.0;
    route-distinguisher 192.168.100.1:1;
    vrf-import import-red;
    vrf-export export-red;
    vrf-table-label;
    protocols {
        bgp {
            group EBGP-RED-CE1 {
                type external;
                peer-as 65001;
                as-override;
                neighbor 10.10.10.2;
            }
        }
   }

}

root@PE-1# show policy-options
policy-statement export-blue {
    term 10 {
        from protocol [ bgp direct ];
        then {
            community add vpn-cust-blue;
            accept;
        }
    }
    term 20 {
        then reject;
    }
}
policy-statement export-red {
    term 10 {
        from protocol [ bgp direct ];
        then {
            community add vpn-cust-red;
            accept;
        }
    }
    term 20 {
        then reject;
    }
}
policy-statement import-blue {
    term 10 {
        from {
            protocol bgp;
            community vpn-cust-blue;
        }
        then accept;
    }
    term 20 {
        then reject;
    }
}
policy-statement import-red {
    term 10 {
        from {
            protocol bgp;
            community vpn-cust-red;
        }
        then accept;
    }
    term 20 {
        then reject;
    }
}

community vpn-cust-red members target:65512:11;

community vpn-cust-blue members target:65512:21;
community vpn-cust-green members target:65512:31;

PE-2

set system host-name PE-2

set interfaces ge-0/0/6 unit 0 family inet address 50.50.50.1/24

set interfaces ge-0/0/7 unit 0 family inet address 20.20.20.1/24

set interfaces ge-0/0/8 unit 0 family inet address 172.22.213.1/24

set interfaces ge-0/0/8 unit 0 family mpls

set interfaces ge-0/0/9 unit 0 family inet address 172.22.212.1/24

set interfaces ge-0/0/9 unit 0 family mpls

set interfaces lo0 unit 0 family inet address 192.168.100.2/32

set routing-options autonomous-system 65512

set protocols rsvp interface ge-0/0/8.0

set protocols rsvp interface ge-0/0/9.0

set protocols mpls no-cspf

set protocols mpls label-switched-path pe2-to-pe1 from 192.168.100.2

set protocols mpls label-switched-path pe2-to-pe1 to 192.168.100.1

set protocols mpls label-switched-path pe2-to-pe3 from 192.168.100.2

set protocols mpls label-switched-path pe2-to-pe3 to 192.168.100.3

set protocols mpls interface ge-0/0/8.0

set protocols mpls interface ge-0/0/9.0

set protocols bgp group IBGP-PE2 type internal

set protocols bgp group IBGP-PE2 local-address 192.168.100.2

set protocols bgp group IBGP-PE2 family inet unicast

set protocols bgp group IBGP-PE2 family inet-vpn unicast

set protocols bgp group IBGP-PE2 neighbor 192.168.100.1

set protocols bgp group IBGP-PE2 neighbor 192.168.100.3

set protocols ospf area 0.0.0.0 interface ge-0/0/9.0

set protocols ospf area 0.0.0.0 interface ge-0/0/8.0

set protocols ospf area 0.0.0.0 interface lo0.0 passive

root@PE-2# show routing-instances
VPN-GREEN {
    instance-type vrf;
    interface ge-0/0/6.0;
    route-distinguisher 192.168.100.2:3;
    vrf-import import-green;
    vrf-export export-green;
    vrf-table-label;
    protocols {
        bgp {
            group EBGP-GREEN-CE1 {
                type external;
                peer-as 65003;
                as-override;
                neighbor 50.50.50.2;
            }
        }
    }
}
VPN-RED {
    instance-type vrf;
    interface ge-0/0/7.0;
    route-distinguisher 192.168.100.2:1;
    vrf-import import-red;
    vrf-export export-red;
    vrf-table-label;
    protocols {
        bgp {
            group EBGP-RED-CE2 {
                type external;
                peer-as 65001;
                as-override;
                neighbor 20.20.20.2;
            }
        }
    }
}

root@PE-2# show policy-options
policy-statement export-green {
    term 10 {
        from protocol [ bgp direct ];
        then {
            community add vpn-cust-green;
            accept;
        }
    }
    term 20 {
        then reject;
    }
}
policy-statement export-red {
    term 10 {
        from protocol [ bgp direct ];
        then {
            community add vpn-cust-red;
            accept;
        }
    }
    term 20 {
        then reject;
    }
}
policy-statement import-green {
    term 10 {
        from {
            protocol bgp;
            community vpn-cust-green;
        }
        then accept;
    }
    term 20 {
        then reject;
    }
}
policy-statement import-red {
    term 10 {
        from {
            protocol bgp;
            community vpn-cust-red;
        }
        then accept;
    }
    term 20 {
        then reject;
    }
}

community vpn-cust-red members target:65512:11;

community vpn-cust-blue members target:65512:21;
community vpn-cust-green members target:65512:31;

PE-3

set system host-name PE-3

set interfaces ge-0/0/5 unit 0 family inet address 172.22.215.1/24

set interfaces ge-0/0/5 unit 0 family mpls

set interfaces ge-0/0/6 unit 0 family inet address 172.22.214.1/24

set interfaces ge-0/0/6 unit 0 family mpls

set interfaces ge-0/0/8 unit 0 family inet address 40.40.40.1/24

set interfaces ge-0/0/9 unit 0 family inet address 60.60.60.1/24

set interfaces lo0 unit 0 family inet address 192.168.100.3/32

set routing-options autonomous-system 65512

set protocols rsvp interface ge-0/0/5.0

set protocols rsvp interface ge-0/0/6.0

set protocols mpls no-cspf

set protocols mpls label-switched-path pe3-to-pe1 from 192.168.100.3

set protocols mpls label-switched-path pe3-to-pe1 to 192.168.100.1

set protocols mpls label-switched-path pe3-to-pe2 from 192.168.100.3

set protocols mpls label-switched-path pe3-to-pe2 to 192.168.100.2

set protocols mpls interface ge-0/0/5.0

set protocols mpls interface ge-0/0/6.0

set protocols bgp group IBGP-PE3 type internal

set protocols bgp group IBGP-PE3 local-address 192.168.100.3

set protocols bgp group IBGP-PE3 family inet unicast

set protocols bgp group IBGP-PE3 family inet-vpn unicast

set protocols bgp group IBGP-PE3 neighbor 192.168.100.1

set protocols bgp group IBGP-PE3 neighbor 192.168.100.2

set protocols ospf area 0.0.0.0 interface ge-0/0/5.0

set protocols ospf area 0.0.0.0 interface ge-0/0/6.0

set protocols ospf area 0.0.0.0 interface lo0.0 passive

root@PE-3# show routing-instances
VPN-BLUE {
    instance-type vrf;
    interface ge-0/0/8.0;
    route-distinguisher 192.168.100.3:2;
    vrf-import import-blue;
    vrf-export export-blue;
    vrf-table-label;
    protocols {
        bgp {
            group EBGP-BLUE-CE2 {
                type external;
                peer-as 65002;
                as-override;
                neighbor 40.40.40.2;
            }
        }
    }
}
VPN-GREEN {
    instance-type vrf;
    interface ge-0/0/9.0;
    route-distinguisher 192.168.100.3:3;
    vrf-import import-green;
    vrf-export export-green;
    vrf-table-label;
    protocols {
        bgp {
            group EBGP-GREEN-CE2 {
                type external;
                peer-as 65003;
                as-override;
                neighbor 60.60.60.2;
            }
        }
    }
}

root@PE-3# show policy-options
policy-statement export-blue {
    term 10 {
        from protocol [ bgp direct ];
        then {
            community add vpn-cust-blue;
            accept;
        }
    }
    term 20 {
        then reject;
    }
}
policy-statement export-green {
    term 10 {
        from protocol [ bgp direct ];
        then {
            community add vpn-cust-green;
            accept;
        }
    }
    term 20 {
        then reject;
    }
}
policy-statement import-blue {
    term 10 {
        from {
            protocol bgp;
            community vpn-cust-blue;
        }
        then accept;
    }
    term 20 {
        then reject;
    }
}
policy-statement import-green {
    term 10 {
        from {
            protocol bgp;
            community vpn-cust-green;
        }
        then accept;
    }
    term 20 {
        then reject;
    }
}

community vpn-cust-red members target:65512:11;

community vpn-cust-blue members target:65512:21;
community vpn-cust-green members target:65512:31;

RED-CE1

set version 14.1R1.10

set system host-name RED-CE1

set interfaces ge-0/0/9 unit 0 family inet address 10.10.10.2/24

set interfaces lo0 unit 0 family inet address 11.11.11.11/32

set routing-options static route 172.11.0.0/24 reject

set routing-options static route 172.11.1.0/24 reject

set routing-options static route 172.11.2.0/24 reject

set routing-options static route 172.11.3.0/24 reject

set routing-options autonomous-system 65001

set protocols bgp group my-ext-group type external

set protocols bgp group my-ext-group export exp-policy

set protocols bgp group my-ext-group peer-as 65512

set protocols bgp group my-ext-group neighbor 10.10.10.1

set policy-options policy-statement exp-policy term 1 from protocol direct

set policy-options policy-statement exp-policy term 1 from route-filter 11.11.11.11/32 exact

set policy-options policy-statement exp-policy term 1 then accept

set policy-options policy-statement exp-policy term 5 from protocol static

set policy-options policy-statement exp-policy term 5 then accept

set policy-options policy-statement exp-policy term 10 then reject

RED-CE2

set system host-name RED-CE2

set interfaces ge-0/0/9 unit 0 family inet address 20.20.20.2/24

set interfaces lo0 unit 0 family inet address 12.12.12.12/32

set routing-options static route 172.12.0.0/24 reject

set routing-options static route 172.12.1.0/24 reject

set routing-options static route 172.12.2.0/24 reject

set routing-options static route 172.12.3.0/24 reject

set routing-options autonomous-system 65001

set protocols bgp group my-ext-group type external

set protocols bgp group my-ext-group export exp-policy

set protocols bgp group my-ext-group peer-as 65512

set protocols bgp group my-ext-group neighbor 20.20.20.1

set policy-options policy-statement exp-policy term 1 from protocol direct

set policy-options policy-statement exp-policy term 1 from route-filter 12.12.12.12/32 exact

set policy-options policy-statement exp-policy term 1 then accept

set policy-options policy-statement exp-policy term 5 from protocol static

set policy-options policy-statement exp-policy term 5 then accept

set policy-options policy-statement exp-policy term 10 then reject

BLUE-CE1

set system host-name BLUE-CE1

set interfaces ge-0/0/9 unit 0 family inet address 30.30.30.2/24

set interfaces lo0 unit 0 family inet address 21.21.21.21/32

set routing-options static route 172.21.0.0/24 reject

set routing-options static route 172.21.1.0/24 reject

set routing-options static route 172.21.2.0/24 reject

set routing-options static route 172.21.3.0/24 reject

set routing-options autonomous-system 65002

set protocols bgp group my-ext-group type external

set protocols bgp group my-ext-group export exp-policy

set protocols bgp group my-ext-group peer-as 65512

set protocols bgp group my-ext-group neighbor 30.30.30.1

set policy-options policy-statement exp-policy term 1 from protocol direct

set policy-options policy-statement exp-policy term 1 from route-filter 21.21.21.21/32 exact

set policy-options policy-statement exp-policy term 1 then accept

set policy-options policy-statement exp-policy term 5 from protocol static

set policy-options policy-statement exp-policy term 5 then accept

set policy-options policy-statement exp-policy term 10 then reject

BLUE-CE2

set system host-name BLUE-CE2

set interfaces ge-0/0/8 unit 0 family inet address 40.40.40.2/24

set interfaces lo0 unit 0 family inet address 22.22.22.22/32

set routing-options static route 172.22.0.0/24 reject

set routing-options static route 172.22.1.0/24 reject

set routing-options static route 172.22.2.0/24 reject

set routing-options static route 172.22.3.0/24 reject

set routing-options autonomous-system 65002

set protocols bgp group my-ext-group type external

set protocols bgp group my-ext-group export exp-policy

set protocols bgp group my-ext-group peer-as 65512

set protocols bgp group my-ext-group neighbor 40.40.40.1

set policy-options policy-statement exp-policy term 1 from protocol direct

set policy-options policy-statement exp-policy term 1 from route-filter 22.22.22.22/32 exact

set policy-options policy-statement exp-policy term 1 then accept

set policy-options policy-statement exp-policy term 5 from protocol static

set policy-options policy-statement exp-policy term 5 then accept

set policy-options policy-statement exp-policy term 10 then reject

GREEN-CE1

set system host-name GREEN-CE1

set interfaces ge-0/0/9 unit 0 family inet address 50.50.50.2/24

set interfaces lo0 unit 0 family inet address 31.31.31.31/32

set routing-options static route 172.31.0.0/24 reject

set routing-options static route 172.31.1.0/24 reject

set routing-options static route 172.31.2.0/24 reject

set routing-options static route 172.31.3.0/24 reject

set routing-options autonomous-system 65003

set protocols bgp group my-ext-group type external

set protocols bgp group my-ext-group export exp-policy

set protocols bgp group my-ext-group peer-as 65512

set protocols bgp group my-ext-group neighbor 50.50.50.1

set policy-options policy-statement exp-policy term 1 from protocol direct

set policy-options policy-statement exp-policy term 1 from route-filter 31.31.31.31/32 exact

set policy-options policy-statement exp-policy term 1 then accept

set policy-options policy-statement exp-policy term 5 from protocol static

set policy-options policy-statement exp-policy term 5 then accept

set policy-options policy-statement exp-policy term 10 then reject

GREEN-CE2

set system host-name GREEN-CE2

set interfaces ge-0/0/9 unit 0 family inet address 60.60.60.2/24

set interfaces lo0 unit 0 family inet address 32.32.32.32/32

set routing-options static route 172.32.0.0/24 reject

set routing-options static route 172.32.1.0/24 reject

set routing-options static route 172.32.2.0/24 reject

set routing-options static route 172.32.3.0/24 reject

set routing-options autonomous-system 65003

set protocols bgp group my-ext-group type external

set protocols bgp group my-ext-group export exp-policy

set protocols bgp group my-ext-group peer-as 65512

set protocols bgp group my-ext-group neighbor 60.60.60.1

set policy-options policy-statement exp-policy term 1 from protocol direct

set policy-options policy-statement exp-policy term 1 from route-filter 32.32.32.32/32 exact

set policy-options policy-statement exp-policy term 1 then accept

set policy-options policy-statement exp-policy term 5 from protocol static

set policy-options policy-statement exp-policy term 5 then accept

set policy-options policy-statement exp-policy term 10 then reject

set system host-name P1

set interfaces ge-0/0/6 unit 0 family inet address 172.22.214.2/24

set interfaces ge-0/0/6 unit 0 family mpls

set interfaces ge-0/0/7 unit 0 family inet address 172.22.202.1/24

set interfaces ge-0/0/7 unit 0 family mpls

set interfaces ge-0/0/8 unit 0 family inet address 172.22.201.1/24

set interfaces ge-0/0/8 unit 0 family mpls

set interfaces ge-0/0/9 unit 0 family inet address 172.22.210.2/24

set interfaces ge-0/0/9 unit 0 family mpls

set interfaces lo0 unit 0 family inet address 192.168.50.1/32

set routing-options autonomous-system 65512

set protocols rsvp interface all

set protocols mpls no-cspf

set protocols mpls interface all

set protocols ospf area 0.0.0.0 interface ge-0/0/6.0

set protocols ospf area 0.0.0.0 interface ge-0/0/9.0

set protocols ospf area 0.0.0.0 interface ge-0/0/8.0

set protocols ospf area 0.0.0.0 interface ge-0/0/7.0

set protocols ospf area 0.0.0.0 interface lo0.0 passive

set system host-name P2

set interfaces ge-0/0/5 unit 0 family inet address 172.22.215.2/24

set interfaces ge-0/0/5 unit 0 family mpls

set interfaces ge-0/0/7 unit 0 family inet address 172.22.204.1/24

set interfaces ge-0/0/7 unit 0 family mpls

set interfaces ge-0/0/8 unit 0 family inet address 172.22.201.2/24

set interfaces ge-0/0/8 unit 0 family mpls

set interfaces ge-0/0/9 unit 0 family inet address 172.22.212.2/24

set interfaces ge-0/0/9 unit 0 family mpls

set interfaces lo0 unit 0 family inet address 192.168.50.2/32

set routing-options autonomous-system 65512

set protocols rsvp interface all

set protocols mpls no-cspf

set protocols mpls interface all

set protocols ospf area 0.0.0.0 interface ge-0/0/5.0

set protocols ospf area 0.0.0.0 interface ge-0/0/9.0

set protocols ospf area 0.0.0.0 interface ge-0/0/8.0

set protocols ospf area 0.0.0.0 interface ge-0/0/7.0

set protocols ospf area 0.0.0.0 interface lo0.0 passive

set system host-name P3

set interfaces ge-0/0/7 unit 0 family inet address 172.22.202.2/24

set interfaces ge-0/0/7 unit 0 family mpls

set interfaces ge-0/0/8 unit 0 family inet address 172.22.211.2/24

set interfaces ge-0/0/8 unit 0 family mpls

set interfaces ge-0/0/9 unit 0 family inet address 172.22.203.1/24

set interfaces ge-0/0/9 unit 0 family mpls

set interfaces lo0 unit 0 family inet address 192.168.50.3/32

set routing-options autonomous-system 65512

set protocols rsvp interface all

set protocols mpls no-cspf

set protocols mpls interface all

set protocols ospf area 0.0.0.0 interface ge-0/0/9.0

set protocols ospf area 0.0.0.0 interface ge-0/0/8.0

set protocols ospf area 0.0.0.0 interface ge-0/0/7.0

set protocols ospf area 0.0.0.0 interface lo0.0 passive

set system host-name P4

set interfaces ge-0/0/7 unit 0 family inet address 172.22.204.2/24

set interfaces ge-0/0/7 unit 0 family mpls

set interfaces ge-0/0/8 unit 0 family inet address 172.22.213.2/24

set interfaces ge-0/0/8 unit 0 family mpls

set interfaces ge-0/0/9 unit 0 family inet address 172.22.203.2/24

set interfaces ge-0/0/9 unit 0 family mpls

set interfaces lo0 unit 0 family inet address 192.168.50.4/32

set routing-options autonomous-system 65512

set protocols rsvp interface all

set protocols mpls no-cspf

set protocols mpls interface all

set protocols ospf area 0.0.0.0 interface ge-0/0/9.0

set protocols ospf area 0.0.0.0 interface ge-0/0/8.0

set protocols ospf area 0.0.0.0 interface ge-0/0/7.0

set protocols ospf area 0.0.0.0 interface lo0.0 passive

~~~ The End ~~~

IPWorld

Saturday, 3 August 2019

MPLS Layer3 VPN LAB

Topology

Topology Description

Objectives

Configurations