Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

English  

English

Example: Configuring Draft Rosen Interoperability and a VPN Tunnel Source

Requirements

Before you begin:

• Configure the router interfaces. See the Junos® OS Network Interfaces.
• Configure an interior gateway protocol or static routing. See the Junos OS Routing Protocols Configuration Guide.
• Configure the VPN. See the Junos OS VPNs Configuration Guide.
• Make sure that the routing devices support multicast tunnel (mt) interfaces for encapsulating and de-encapsulating data packets into tunnels. See Tunnel Services PICs and Multicast and Load Balancing Multicast Tunnel Interfaces Among Available PICs.

  For multicast to work on draft-rosen Layer 3 VPNs, each of the following routers must have tunnel interfaces:

  • Each provider edge (PE) router.
  • Any provider (P) router acting as the RP.
  • Any customer edge (CE) router that is acting as a source's DR or as an RP. A receiver's designated router does not need a Tunnel Services PIC.

Overview

By default, the local loopback address configured in a VPN routing and forwarding (VRF) routing instance is used as the source address when PIM hello messages, join messages, and prune messages are sent over multicast tunnel interfaces.

In the Junos OS default implementation of draft-rosen, mt interfaces are created dynamically in each VRF. PIM hello messages are sent over the mt interfaces to discover neighbors in the same VPN. The Junos OS requires that the lo0.mvpn address be configured in each routing instance. The local lo0.mvpn address is used as the source address when building PIM hello, join, and prune messages over the mt interface. The lo0.mvpn address is independent in routing instances and can be different from the lo0.main address in the master instance. All the source and destination address lookups and RPF checks are done in the routing instance.

For compatibility with certain other vendors’ routers, the address used in the VRF routing instance for multicast tunnel interfaces must be the same as the primary loopback address configured in the master routing instance. In this example, mt interfaces use lo0.0 as the source address. Each VRF routing instance uses the lo0.0 address as the source address when sending PIM control packets over the mt interface.

• The loopback address specified is configured in the master routing instance.
• The inet address family is enabled on the interface.

This example also configures a specific VPN tunnel source address in one routing instance. That address, instead of the lo0.main address, is used as the source address for the mt interface in that routing instance. The tunnel source is a static local address that is routable in the master instance. The routing instance uses the VPN tunnel source to form PIM neighbors over the mt interface. This enables different routing instances to take different paths even in the provider domain.

Note: For information about upgrading Juniper Networks routers from a software release that does not support the default-vpn-source configuration statement to a release that does, see the Juniper Networks Junos 10.1 Software Release Notes .

• default-vpn-source—In the master instance, changes the draft-rosen behavior so that the primary loopback address configured in the master routing instance is the multicast tunnel interface address in all VRF routing instances. Because the configuration includes default-vpn-source, you do not need to configure loopback addresses in the routing instances.
• tunnel-source—In the vrf-blue routing instance, overrides the default-vpn-source statement. The vrf-blue routing instance (because it contains the tunnel-source statement) overrides the default-vpn-source statement and uses the address configured on lo0.200 as the source address. This address is 192.27.11.136 in this example. However, vrf-white does not contain the tunnel-source statement. In this case, the default-vpn-source statement takes effect, and vrf-white uses the address configured on lo0.0 as the source address. This address is 192.27.0.136 in this example.

Figure 1 shows the topology used in this example.

Figure 1: VPN Tunnel Source Topology

This example shows the Junos OS configuration on Device PE2.

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Step-by-Step Procedure

1. On the PE routers, configure the interfaces.

   [edi interfacest]user@PE2# set fe-4/3/0 description "TO CE2"user@PE2# set fe-4/3/0 unit 0 family inet address 1.2.3.1/24user@PE2# set fe-4/3/0 unit 0 family isouser@PE2# set fe-4/3/0 unit 0 family mpls
   user@PE2# set so-2/3/0 description "TO PE1"user@PE2# set so-2/3/0 sonet-options fcs 32user@PE2# set so-2/3/0 sonet-options no-payload-scrambleruser@PE2# set so-2/3/0 unit 0 family inet address 1.1.2.2/24user@PE2# set so-2/3/0 unit 0 family isouser@PE2# set so-2/3/0 unit 0 family mpls
   user@PE2# set lo0 unit 1 family inet address 10.255.70.103/32

2. Configure the MPLS and a signaling protocol.

   [edit protocols mpls]user@PE2# set interface alluser@PE2# set interface fxp0.0 disable
   [edit protocols ldp]user@PE2# set interface alluser@PE2# set interface fxp0.0 disable

3. Configure the routing protocols in the master instance.

   [edit protocols bgp group int]user@PE2# set type internaluser@PE2# set local-address 10.255.70.103user@PE2# set family inet unicastuser@PE2# set family inet-vpn unicastuser@PE2# set family inet-vpn multicastuser@PE2# set family inet-mdt signalinguser@PE2# set neighbor 10.10.10.10
   [edit protocols ospf area 0.0.0.0]user@PE2# set interface alluser@PE2# set interface fxp0.0 disable

4. Configure PIM with the default-vpn-source statement.

   [edit protocols pim]user@PE2# set interface lo0.0user@PE2# set interface alluser@PE2# set interface fxp0.0 disableuser@PE2# set default-vpn-source

5. Configure the routing policy.

   [edit policy-options policy-statement bgp_ospf term 1]user@PE2# set from protocol bgpuser@PE2# set then accept

6. Configure the routing instance.

   [edit routing-instances vpna]user@PE2# set instance-type vrfuser@PE2# set interface fe-4/3/0.0user@PE2# set interface lo0.1user@PE2# set route-distinguisher 1:0user@PE2# set provider-tunnel pim-ssm group-address 232.1.1.1user@PE2# set vrf-target target:1:1user@PE2# set protocols ospf export bgp_ospfuser@PE2# set protocols ospf area 0.0.0.0 interface lo0.1 passiveuser@PE2# set protocols ospf area 0.0.0.0 interface fe-4/3/0.0user@PE2# set protocols pim mvpn autodiscovery inet-mdtuser@PE2# set protocols pim rp local address 10.255.70.103user@PE2# set protocols pim interface lo0.1user@PE2# set protocols pim interface fe-4/3/0.0user@PE2# set protocols mvpn autodiscovery-only intra-as inclusive

7. Configure the routing table options.

   [edit routing-options]user@PE2# set autonomous-system 1

8. If you are done configuring the device, commit the configuration.

   user@PE2# commit

Results

From configuration mode, confirm your configuration by entering the show interfaces, show policy-options, show protocols, show routing-instances, and show routing-options commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

Verification

To verify the configuration, run the show pim mdt instance vpna should show the data MDT and the VPN tunnel source. Other useful commands are show pim join (main instance), show multicast route, and show pim neighbors.