Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring Proxy BGP Route Target Filtering

Requirements

This example uses the following hardware and software components:

• Four Juniper Networks devices that can be a combination of M Series, MX Series, or T Series routers.
• Junos OS Release 12.2 or later on one or more devices configured for proxy BGP route filtering. In this example, you explicitly configure proxy BGP route filtering on the route reflectors.

• Layer 2 VPNs
• Layer 3 VPNs
• Route distinguishers
• Route targets
• BGP route target filtering
• BGP extended communities

Overview

Route target filtering decreases the number of devices in a network that receive VPN routes that are not needed. Proxy BGP route target filtering allows networks to take advantage of route target filtering in locations where the feature is not currently supported. By configuring this feature, you can realize many of the same network resource savings that are available to you if your network fully supported BGP route target filtering.

To configure proxy BGP route target filtering, you include the family route-target proxy-generate statement on the devices that will distribute proxy route target membership (RT membership) advertisements for the devices that do not support BGP route target filtering. The proxy BGP route target filtering routes are then stored in the bgp.rtarget.0 routing table.

Proxy BGP route target filtering is intended to create RT membership advertisements for devices that do not support the BGP route target filtering feature. If the proxy-generate statement is present, but the route target family is negotiated with the BGP peer, the proxy-generate functionality is disabled. This allows simplified configuration of BGP peer groups where a portion of the peers in the group support route target filtering but others do not. In such an example case, the family route-target proxy-generate statement might be part of the BGP peer group configuration.

Note: When deploying proxy BGP route target filtering in your network, the advertise-default statement for BGP route target filtering causes the device to advertise the default route target route (0:0:0/0) and suppress all routes that are more specific. If you have proxy BGP route target filtering configured on one device and one or more peers have the advertise-default statement configured as part of their BGP route target filtering configuration, the advertise-default configuration is ignored.

Topology Diagram

Figure 1 shows the topology used in this example.

Figure 1: Proxy BGP Route Target Filtering Topology

In this example, BGP route target filtering is configured on the route reflectors (Device RR1 and Device RR2) and the provider edge (PE) Device PE2, but the other PE, Device PE1, does not support the BGP route target filtering functionality. Device PE2 has four VPNs configured (vpn1, vpn2, vpn3, and vpn4). Device PE1 has two VPNs configured (vpn1 and vpn2), so this device is only interested in receiving route updates for vpn1 and vpn2. Currently, this is impossible because both route reflectors (Device RR1 and Device RR2) learn and share information about all of the incoming VPN routes (vpn1 through vpn4) with Device PE1. In the sample topology, all devices participate in autonomous system (AS) 200, OSPF is the configured interior gateway protocol (IGP), and LDP is the signaling protocol used by the VPNs. In this example, we use static routes in the VPN routing and forwarding (VRF) instances to generate VPN routes. This is done in place of using a PE to customer edge (CE) protocol such as OSPF or BGP.

To minimize the number of VPN route updates being processed by Device PE1, you include the family route-target proxy-generate statement to configure proxy BGP route target filtering on each route reflector. Each route reflector has a peering session with Device PE1 and supports route target filtering to the core. However, Device PE1 does not support route target filtering, so the network resource savings are unrealized by Device PE1 since it receives all of the VPN updates. By configuring proxy BGP route target filtering on the peering sessions facing Device PE1, you limit the number of VPN updates processed by Device PE1, and the route reflectors generate the proxy BGP route target routes for Device PE1 throughout the network.

Configuration

• Configuring Device PE1
• Configuring Device RR1
• Configuring Device RR2
• Configuring Device PE2

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Configuring Device PE1

Step-by-Step Procedure

1. Configure the interfaces.
   [edit interfaces]user@PE1# set ge-1/0/0 unit 0 description PE1-to-RR1user@PE1# set ge-1/0/0 unit 0 family inet address 10.49.0.1/30user@PE1# set ge-1/0/0 unit 0 family mplsuser@PE1# set ge-1/0/1 unit 0 description PE1-to-RR2user@PE1# set ge-1/0/1 unit 0 family inet address 10.49.10.1/30user@PE1# set ge-1/0/1 unit 0 family mpls
2. Configure the route distinguisher and the AS number.
   [edit routing-options]user@PE1# set route-distinguisher-id 10.255.163.58user@PE1# set autonomous-system 200
3. Configure LDP as the signaling protocol used by the VPN.
   [edit protocols ldp]user@PE1# set interface ge-1/0/0user@PE1# set interface ge-1/0/1
4. Configure BGP.
   [edit protocols bgp group internal]user@PE1# set type internaluser@PE1# set local-address 10.255.163.58user@PE1# set neighbor 10.255.165.220 family inet-vpn unicastuser@PE1# set neighbor 10.255.165.28 family inet-vpn unicast
5. Configure OSPF.
   [edit protocols ospf area 0.0.0.0]user@PE1# set interface ge-1/0/0user@PE1# set interface ge-1/0/1user@PE1# set interface lo0.0 passive
6. Configure the VPN routing instances.
   [edit routing-instances vpn1]user@PE1# set instance-type vrfuser@PE1# set vrf-target target:200:100user@PE1# set routing-options static route 223.1.1.2/32 discard
   [edit routing-instances vpn2]user@PE1# set instance-type vrfuser@PE1# set vrf-target target:200:101user@PE1# set routing-options static route 223.2.2.2/32 discard
7. If you are done configuring the device, commit the configuration.
   [edit]user@PE1# commit

Results

From configuration mode, confirm your configuration by entering the show interfaces, show protocols, show routing-options, and show routing-instances commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

Configuring Device RR1

Step-by-Step Procedure

1. Configure the interfaces.
   [edit interfaces]user@RR1# set ge-1/0/0 unit 0 description RR1-to-PE1user@RR1# set ge-1/0/0 unit 0 family inet address 10.49.0.2/30user@RR1# set ge-1/0/0 unit 0 family mplsuser@RR1# set ge-1/0/1 unit 0 description RR1-to-PE2user@RR1# set ge-1/0/1 unit 0 family inet address 10.50.0.2/30user@RR1# set ge-1/0/1 unit 0 family mpls
2. Configure the route distinguisher and the AS number.
   [edit routing-options]user@RR1# set route-distinguisher-id 10.255.165.220user@RR1# set autonomous-system 200
3. Configure LDP as the signaling protocol used by the VPN.
   [edit protocols ldp]user@RR1# set interface ge-1/0/0user@RR1# set interface ge-1/0/1
4. Configure BGP.
   [edit protocols bgp group internal]user@RR1# set type internaluser@RR1# set local-address 10.255.165.220user@RR1# set cluster 1.1.1.1user@RR1# set neighbor 10.255.163.58 description vpn1-to-pe1 family inet-vpn unicastuser@RR1# set neighbor 10.255.168.42 description vpn1-to-pe2 family inet-vpn unicast
5. Configure BGP route target filtering on the peering session with Device PE2.
   [edit protocols bgp group internal]user@RR1# set neighbor 10.255.168.42 family route-target
6. Configure proxy BGP route target filtering on the peering session with Device PE1.
   [edit protocols bgp group internal]user@RR1# set neighbor 10.255.163.58 family route-target proxy-generate
7. Configure OSPF.
   [edit protocols ospf area 0.0.0.0]user@RR1# set interface ge-1/0/0user@RR1# set interface ge-1/0/1user@RR1# set interface lo0.0 passive
8. If you are done configuring the device, commit the configuration.
   [edit]user@RR1# commit

Results

From configuration mode, confirm your configuration by entering the show interfaces, show protocols and show routing-options commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

Configuring Device RR2

Step-by-Step Procedure

1. Configure the interfaces.
   [edit interfaces]user@RR2# set ge-1/0/0 unit 0 description RR2-to-PE1user@RR2# set ge-1/0/0 unit 0 family inet address 10.49.10.2/30user@RR2# set ge-1/0/0 unit 0 family mplsuser@RR2# set ge-1/0/1 unit 0 description RR2-to-PE2user@RR2# set ge-1/0/1 unit 0 family inet address 10.50.10.2/30user@RR2# set ge-1/0/1 unit 0 family mpls
2. Configure the route distinguisher and the AS number.
   [edit routing-options]user@RR2# set route-distinguisher-id 10.255.165.28user@RR2# set autonomous-system 200
3. Configure LDP as the signaling protocol used by the VPN.
   [edit protocols ldp]user@RR2# set interface ge-1/0/0user@RR2# set interface ge-1/0/1
4. Configure BGP.
   [edit protocols bgp group internal]user@RR2# set type internaluser@RR2# set local-address 10.255.165.28user@RR2# set cluster 1.1.1.1user@RR2# set neighbor 10.255.163.58 description vpn2-to-pe1 family inet-vpn unicastuser@RR2# set neighbor 10.255.168.42 description vpn2-to-pe2 family inet-vpn unicast
5. Configure BGP route target filtering on the peering session with Device PE2.
   [edit protocols bgp group internal]user@RR2# set neighbor 10.255.168.42 family route-target
6. Configure proxy BGP route target filtering on the peering session with Device PE1.
   [edit protocols bgp group internal]user@RR2# set neighbor 10.255.163.58 family route-target proxy-generate
7. Configure OSPF.
   [edit protocols ospf area 0.0.0.0]user@RR2# set interface ge-1/0/0user@RR2# set interface ge-1/0/1user@RR2# set interface lo0.0 passive
8. If you are done configuring the device, commit the configuration.
   [edit]user@RR2# commit

Results

From configuration mode, confirm your configuration by entering the show interfaces, show protocols, and show routing-options commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

Configuring Device PE2

Step-by-Step Procedure

1. Configure the interfaces.
   [edit interfaces]user@PE2# set ge-1/0/0 unit 0 description PE2-to-RR1user@PE2# set ge-1/0/0 unit 0 family inet address 10.50.0.1/30user@PE2# set ge-1/0/0 unit 0 family mplsuser@PE2# set ge-1/0/1 unit 0 description PE2-to-RR2user@PE2# set ge-1/0/1 unit 0 family inet address 10.50.10.2/30user@PE2# set ge-1/0/1 unit 0 family mpls
2. Configure the route distinguisher and the AS number.
   [edit routing-options]user@PE2# set route-distinguisher-id 10.255.168.42user@PE2# set autonomous-system 200
3. Configure LDP as the signaling protocol used by the VPN.
   [edit protocols ldp]user@PE2# set interface ge-1/0/0user@PE2# set interface ge-1/0/1
4. Configure BGP.
   [edit protocols bgp group internal]user@PE2# set type internaluser@PE2# set local-address 10.255.168.42user@PE2# set family inet-vpn unicastuser@PE2# set family route-targetuser@PE2# set neighbor 10.255.165.220user@PE2# set neighbor 10.255.165.28
5. Configure OSPF.
   [edit protocols ospf area 0.0.0.0]user@PE2# set interface ge-1/0/0user@PE2# set interface ge-1/0/1user@PE2# set interface lo0.0 passive
6. Configure the VPN routing instances.
   [edit routing-instances vpn1]user@PE2# set instance-type vrfuser@PE2# set vrf-target target:200:100user@PE2# set routing-options static route 223.1.1.2/32 discard
   [edit routing-instances vpn2]user@PE2# set instance-type vrfuser@PE2# set vrf-target target:200:101user@PE2# set routing-options static route 223.2.2.2/32 discard
   [edit routing-instances vpn3]user@PE2# set instance-type vrfuser@PE2# set vrf-target target:200:103user@PE2# set routing-options static route 223.3.3.3/32 discard
   [edit routing-instances vpn4]user@PE2# set instance-type vrfuser@PE2# set vrf-target target:200:104user@PE2# set routing-options static route 223.4.4.4/32 discard
7. If you are done configuring the device, commit the configuration.
   [edit]user@PE2# commit

Results

From configuration mode, confirm your configuration by entering the show interfaces, show protocols, show routing-options, and show routing-instances commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

Verification

Confirm that the configuration is working properly.

Verifying the Proxy BGP Route Target Routes

Purpose

Verify that the proxy BGP route target routes are displayed in the bgp.rtarget.0 table on Device RR1.

Action

From operational mode, enter the show route table bgp.rtartget.0 command to display the proxy BGP route targets.

4 destinations, 6 routes (4 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

200:200:100/96                
                   *[RTarget/5] 00:01:22
                      Type Proxy
                        for 10.255.163.58
                         Local
                    [BGP/170] 00:04:55, localpref 100, from 10.255.168.42
                      AS path: I, validation-state: unverified
                    > to 10.50.0.1 via ge-1/0/1
200:200:101/96                
                   *[RTarget/5] 00:01:22
                      Type Proxy
                        for 10.255.163.58
                         Local
                    [BGP/170] 00:04:55, localpref 100, from 10.255.168.42
                      AS path: I, validation-state: unverified
                    > to 10.50.0.1 via ge-1/0/1
200:200:103/96                
                   *[BGP/170] 00:04:55, localpref 100, from 10.255.168.42
                      AS path: I, validation-state: unverified
                    > to 10.50.0.1 via ge-1/0/1
200:200:104/96                
                   *[BGP/170] 00:04:55, localpref 100, from 10.255.168.42
                      AS path: I, validation-state: unverified
                    > to 10.50.0.1 via ge-1/0/1

Meaning

Device RR1 is generating the proxy BGP route target routes on behalf of its peer Device PE1. The proxy BGP route target routes are identified with the protocol and preference [RTarget/5] and the route target type of Proxy.