Interprovider VPNs
Interprovider VPNs provide connectivity between separate ASs. This functionality might be used by a VPN customer who has connections to several different ISPs, or different connections to the same ISP in different geographic regions, each of which has a different AS. Figure 1 illustrates the type of network topology used by an interprovider VPN.
Figure 1: Interprovider VPN Network Topology
The following sections describe the ways you can configure an interprovider VPN:
Linking VRF Tables Between Autonomous Systems
You can connect two separate ASs by simply linking the VPN routing and forwarding (VRF) table in the AS border router of one AS to the VRF table in the AS border router in the other AS. Each AS border router must contain a VRF instance for every VPN configured in both service provider networks. You then configure an IP session between the two AS border routers. In effect, the AS border routers treat each other as customer edge (CE) routers.
Because of the complexity of the configuration, particularly with regard to scaling, this method is not recommended. The details of this configuration are not provided in this manual.
Configuring MP-EBGP Between AS Border Routers
In this approach, the PE routers within an AS use multiprotocol external BGP (MP-EBGP) to distribute labeled VPN–Internet Protocol version 4 (IPv4) routes to an AS border router or to a route reflector of which the AS border router is a client. The AS border router uses multiprotocol external BGP (MP-EBGP) to distribute the labeled VPN-IPv4 routes to its peer AS border router in the neighboring AS. The peer AS border router then uses MP-IBGP to distribute labeled VPN-IPv4 routes to PE routers, or to a route reflector of which the PE routers are a client.
This approach to configuring interprovider VPNs across autonomous systems is also called next generation Layer 3 VPNs. You can configure both unicast (Junos OS Release 9.5 and later) and multicast (Junos OS Release 12.1 and later) next generation Layer 3 VPNs across ASs. Although there are a number of different network configurations that can be used to enable inter-AS support for next generation VPN traffic, the Junos OS software supports only next generation VPN option A and option C:
- Option A—This is simple though less scaleable interprovider
VPN solution to the problem of providing VPN services to a customer
that has different sites, not all of which can use the same service
provider (SP). In this implementation, the VPN routing and forwarding
(VRF) table in the ASBR of one AS is linked to the VRF table in the
ASBR in the other AS. Each ASBR must contain a VRF instance for every
VPN configured in both service provider networks. Then an IGP or BGP
must be configured between the ASBRs.
Option C—The customer service provider depends on the VPN service provider to deliver a VPN transport service between the customer service provider’s points of presence (POPs) or regional networks. This functionality might be used by a VPN customer who has connections to several different Internet service providers (ISPs), or different connections to the same ISP in different geographic regions, each of which has a different AS number. In this implementation, only routes internal to the service provider networks are announced between ASBRs. This is achieved by using the family inet labeled-unicast statements in the IBGP and EBGP configuration on the PE routers. Labeled IPv4 (not VPN-IPv4) routes are exchanged by the ASBRs to support MPLS. An MP-EBGP session between the end PE routers is used for the announcement of VPN-IPv4 routes. In this manner, VPN connectivity is provided while keeping VPN-IPv4 routes out of the core network.
Configuring Multihop MP-EBGP Between AS Border Routers
In this type of interprovider VPN configuration, P routers do not need to store all the routes in all the VPNs. Only the PE routers must have all the VPN routes. The P routers simply forward traffic to the PE routers—they do not store or process any information about the packets’ destination. The connections between the AS border routers in separate ASs forward traffic between the ASs, much as a label-switched path (LSP) works.
The following are the basic steps you take to configure an interprovider VPN in this manner:
- Configure multihop EBGP redistribution of labeled VPN-IPv4 routes between the source and destination ASs.
- Configure EBGP to redistribute labeled IPv4 routes from its AS to neighboring ASs.
- Configure MPLS on the end PE routers of the VPNs.
