Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

TechLibrary
Navigation

Example: SCU with Layer 3 VPNs Configuration

Example: SCU in a Layer 3 VPN Configuration

Figure 1: SCU in a Layer 3 VPN Topology Diagram

SCU in a Layer 3 VPN Topology Diagram

Figure 1 displays a Layer 3 VPN topology. CE1 and CE2 are customer edge (CE) routers connected by a VPN through provider routers PE1, P0, and PE2. EBGP is established between routers CE1 and PE1, IBGP connects routers PE1 and PE2 over an IS-IS/MPLS/LDP core, and a second EBGP connection flows between routers PE2 and CE2.

On Router CE1, begin your VPN by setting up an EBGP connection to PE1. Install a static route of 10.114.1.0/24 and advertise this route to your EBGP neighbor.

Router CE1

[edit]interfaces {ge-0/0/0 {unit 0 {family inet {address 10.20.250.1/30;}}}}routing-options {static {route 10.114.1.0/24 reject;}autonomous-system 100;}protocols {bgp {group to-pe1 {local-address 10.20.250.1;export inject-direct;peer-as 300;neighbor 10.20.250.2;}}}policy-options {policy-statement inject-direct {term 1 {from {protocol static;route-filter 10.114.1.0/24 exact;}then accept;}term 2 {from protocol direct;then accept;}}}

On PE1, complete the EBGP connection to CE1 through a VRF routing instance. Set an export policy for your VRF instance that puts BGP traffic into a community, and an import policy that accepts like community traffic from your VPN neighbor. Lastly, configure an IBGP relationship to Router PE2 that runs over an IS-IS, MPLS, and LDP core.

Router PE1

[edit]interfaces {ge-0/0/1 {unit 0 {family inet {address 10.20.250.2/30;}}}so-0/2/1 {unit 0 {family inet {address 10.20.251.1/30;}family iso;family mpls;}}lo0 {unit 0 {family inet {address 10.250.245.245/32;}family iso;family mpls;}}}routing-options {autonomous-system 300;}protocols {mpls {interface so-0/2/1;}bgp {group ibgp {type internal;local-address 10.250.245.245;family inet-vpn {unicast;}neighbor 10.250.71.14;}}isis {interface so-0/2/1;}ldp {interface so-0/2/1;}}policy-options {policy-statement red-import {from {protocol bgp;community red-com;}then accept;}policy-statement red-export {from protocol bgp;then {community add red-com;accept;}}community red-com members target:20:20;}routing-instances {red {instance-type vrf;interface ge-0/0/1.0;route-distinguisher 10.250.245.245:100;vrf-import red-import;vrf-export red-export;protocols {bgp {group to-ce1 {local-address 10.20.250.2;peer-as 100;neighbor 10.20.250.1;}}}}}

On P0, connect the IBGP neighbors located at PE1 and PE2. Remember to include VPN-related protocols (MPLS, LDP, and IGP) on all interfaces.

Router P0

[edit]interfaces {so-0/1/0 {unit 0 {family inet {address 10.20.252.1/30;}family iso;family mpls;}}so-0/2/0 {unit 0 {family inet {address 10.20.251.2/30;}family iso;family mpls;}}lo0 {unit 0 {family inet {address 10.250.245.246/32;}family iso;family mpls;}}}routing-options {autonomous-system 300;}protocols {mpls {interface so-0/1/0;interface so-0/2/0;}isis {interface all;}ldp {interface all;}}

On PE2, complete the IBGP relationship to Router PE1. Establish an EBGP connection to CE2 through a VRF routing instance. Set an export policy for the VRF instance that places BGP traffic into a community, and an import policy that accepts like community traffic from the VPN neighbor. Next, establish a policy that adds the static route from CE1 to a source class called GOLD1. Also, export this SCU policy into the forwarding table. Finally, set your vt interface as the SCU input interface and establish the CE-facing interface so-0/0/0 as the SCU output interface.

Router PE2

[edit]interfaces {so-0/1/1 {unit 0 {family inet {address 10.20.252.2/30;}family iso;family mpls;}}so-0/0/0 {unit 0 {family inet {accounting {source-class-usage {output;}}address 10.20.253.1/30;}}}vt-4/1/0 {unit 0 {family inet {accounting {source-class-usage {input;}}address 10.250.71.14/32;}family iso;family mpls;}}}routing-options {autonomous-system 300;forwarding-table {export inject-customer2-dest-class;}}protocols {mpls {interface so-0/1/1;interface vt-4/1/0;}bgp {group ibgp {type internal;local-address 10.250.71.14;family inet-vpn {unicast;}neighbor 10.250.245.245;}}isis {interface so-0/1/1;}ldp {interface so-0/1/1;}}routing-instances {red {instance-type vrf;interface so-0/0/0.0;interface vt-4/1/0.0;route-distinguisher 10.250.71.14:100;vrf-import red-import;vrf-export red-export;protocols {bgp {group to-ce2 {local-address 10.20.253.1;peer-as 400;neighbor 10.20.253.2;}}}}}policy-options {policy-statement red-import {from {protocol bgp;community red-com;}then accept;}policy-statement red-export {from protocol bgp;then {community add red-com;accept;}}policy-statement inject-customer2-dest-class {term term-gold1-traffic {from {route-filter 10.114.1.0/24 exact;}then source-class GOLD1;}}community red-com members target:20:20;}

On Router CE2, complete the VPN path by finishing the EBGP connection to PE2.

Router CE2

[edit]interfaces {so-0/0/1 {unit 0 {family inet {address 10.20.253.2/30;}}}}routing-options {autonomous-system 400;}protocols {bgp {group to-pe2 {local-address 10.20.253.2;export inject-direct;peer-as 300;neighbor 10.20.253.1;}}}policy-options {policy-statement inject-direct {from {protocol direct;}then accept;}}

Verifying Your Work

To verify that SCU is functioning properly in the Layer 3 VPN, use the following commands:

  • show interfaces interface-name statistics
  • show interfaces source-class source-class-name interface-name
  • show interfaces interface-name (extensive | detail)
  • show route (extensive | detail)
  • clear interface interface-name statistics

You should always verify SCU statistics at the outbound SCU interface on which you configured the output statement. To check SCU functionality, follow these steps:

  1. Clear all counters on your SCU-enabled router and verify they are empty.
  2. Send a ping from the ingress CE router to the second CE router to generate SCU traffic across the SCU-enabled VPN route.
  3. Verify that the counters are incrementing correctly on the outbound interface.

The following section shows the output of these commands used with the configuration example.

user@pe2> clear interfaces statistics all
	user@pe2> show interfaces so-0/0/0.0 statistics
  	Logical interface so-0/0/0.0 (Index 6) (SNMP ifIndex 113) 
    Flags: Point-To-Point SNMP-Traps Encapsulation: PPP
    Protocol inet, MTU: 4470
      Source class                             Packets                Bytes
 GOLD1                          0                    0
      Addresses, Flags: Is-Preferred Is-Primary

	user@pe2> show interfaces source-class GOLD1 so-0/0/0.0    
    Protocol inet
      Source class                             Packets                Bytes
GOLD1                          0                    0

user@ce1> ping 10.20.253.2 source 10.114.1.1 rapid count 10000

user@scu>  show interfaces source-class GOLD1 so-0/0/0.0
    Protocol inet
      Source class                             Packets                Bytes
GOLD1                      20000              1680000

user@scu>  show interfaces so-0/0/0.0 statistics
  Logical interface so-0/0/0.0 (Index 6) (SNMP ifIndex 113) 
    Flags: Point-To-Point SNMP-Traps Encapsulation: PPP
    Protocol inet, MTU: 4470
      Source class                             Packets                Bytes
GOLD1                      20000              1680000
      Addresses, Flags: Is-Preferred Is-Primary
         Destination: 10.20.253/24, Local: 10.20.253.1
 

Related Documentation

 

Published: 2012-12-03

Previous Page Next Page