Supported Platforms
Routing VPN and Internet Traffic Through Different Interfaces
In this example, VPN and Internet traffic are routed through different interfaces. The CE router sends the VPN traffic through the VPN interface and sends the Internet traffic through a separate interface that is part of the main routing table on Router PE1 (the CE router can use either one physical interface with two logical units or two physical interfaces). NAT also occurs on the CE router (see Figure 1).
Figure 1: Routing VPN and Internet Traffic Through Different Interfaces
The PE router is configured to install and advertise the public IP address pool for the VPN to other core routers (for return traffic). The VPN traffic is routed normally. Figure 2 illustrates the PE router’s VPN configuration.
Figure 2: Example of Internet Traffic Routed Through Separate Interfaces
The configuration in this example has the following features:
- Router PE1 uses two logical interfaces to connect to Router CE1 using Frame Relay encapsulation.
- The routing protocol between Router PE1 and Router CE1 is EBGP.
- Router CE1’s public IP address pool is 10.12.1.1 through 10.12.1.254 (10.12.1.0/24).
- The next-hop-self setting is derived from the fix-nh policy statement on Router PE1. PE routers are forced to use next-hop-self so that next-hop resolution is done only for the PE router’s loopback address for non-VPN routes (by default, VPN–Internet Protocol version 4 [IPv4] routes are sent by means of next-hop-self).
You can configure Router CE1 with a static default route pointing to its public interface for everything else.
The following sections show how to route VPN and Internet traffic through different interfaces:
Configuring Interfaces on Router PE1
Configure an interface to handle VPN traffic and an interface to handle Internet traffic:
Configuring Routing Options on Router PE1
Configure a static route on Router PE1 to install a route to the CE router’s public IP address pool in inet.0:
Configuring BGP, IS-IS, and LDP Protocols on Router PE1
Configure BGP on Router PE1 to allow non-VPN and VPN peering and to advertise the VPN’s public IP address pool:
Configure IS-IS on Router PE1 to allow access to internal routes:
Configure LDP on Router PE1 to tunnel VPN routes:
Configuring a Routing Instance on Router PE1
Configure a routing instance on Router PE1:
Configuring Policy Options on Router PE1
You need to configure policy options on Router PE1. The fix-nh policy statement sets next-hop-self for all non-VPN routes:
The redist-static policy statement advertises the VPN’s public IP address pool:
Configure import and export policies for vpna:
Traffic Routed by Different Interfaces: Configuration Summarized by Router
Router PE1
Interfaces
Routing Options
BGP Protocol
IS-IS Protocol
LDP Protocol
Routing Instance
Policy Options/Policy Statements
Import and Export Policies
