Rate and give feedback:  Feedback Received. Thank You!

Rate and give feedback: 

X

This document helped resolve my issue

Yes No

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:  

E-mail: 

Enter a valid Email ID

Need product assistance? Contact Juniper Support

Submit

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.

Example: Configuring MPLS-Based Layer 3 VPNs

Requirements

Overview and Topology

Layer 3 VPNs allow customers to leverage the service provider’s technical expertise to ensure efficient site-to-site routing. The customer’s customer edge (CE) switch uses a routing protocol such as BGP or OSPF to communicate with the service provider’s provider edge (PE) switch to carry IP prefixes across the network. MPLS-based Layer 3  VPNs use only IP over MPLS; other protocol packets are not supported. This example includes two PE switches, PE1 and PE2.

In the basic MPLS configuration of the PE switches using IP over MPLS, the PE switches were configured to use OSPF as the routing protocol between the MPLS switches and RSVP as the signaling protocol. Traffic engineering was enabled. A label-switched path (LSP) was configured.

The following components must be added to the PE switches for an MPLS-based Layer 3 VPN:

• BGP group with family inet-vpn unicast
• Routing instance with instance type vrf

Figure 1 illustrates the topology of this MPLS-based Layer 3 VPN.

Figure 1: MPLS-Based Layer 3 VPN

Table 1 shows the settings of the customer edge interface on the local CE switch.

Table 2 shows the settings of the customer edge interface on the remote CE switch.

Table 3 shows the Layer 3 VPN components of the local PE switch.

Table 4 shows the Layer 3 VPN components of the remote PE switch.

Configuring the Local PE Switch

CLI Quick Configuration

To quickly configure the Layer 3 VPN components on the local PE switch, copy the following commands and paste them into the switch terminal window of PE1:

Step-by-Step Procedure

1. Configure BGP, specifying the loopback address as the local address and specifying family inet-vpn unicast:
   [edit protocols bgp]
user@switchPE1# set local-address 21.21.21.21 family inet-vpn unicast
2. Configure the BGP group, specifying the group name and type:
   [edit protocols bgp]
user@switchPE1# set group PE1-PE2 type internal
3. Configure the BGP neighbor, specifying the loopback address of the remote PE switch as the neighbor’s address:
   [edit protocols bgp]
user@switchPE1# set neighbor 22.22.22.22
4. Configure the routing instance, specifying the routing-instance name and using vrf as the instance type:
   [edit routing-instances]
user@switchPE1# set L3VPN-1 instance-type vrf
5. Configure a description for this routing instance:
   [edit routing-instances]
user@switchPE1# set L3VPN-1 description "BETWEEN PE1 AND PE2"
6. Configure the routing instance to use a route distinguisher:
   [edit routing-instances]
user@switchPE1# set L3VPN-1 route-distinguisher 21:21

   Note: Each routing instance that you configure on a PE switch must have a unique route distinguisher associated with it. VPN routing instances require a route distinguisher to allow BGP to distinguish between potentially identical network layer reachability information (NLRI) messages received from different VPNs. If you configure different VPN routing instances with the same route distinguisher, the commit fails.

7. Configure the VPN routing and forwarding (VRF) target of the routing instance:
   [edit routing-instances]
user@switchPE1# set L3VPN-1 vrf-target target:21:21

   Note: You can create more complex policies by explicitly configuring VRF import and export policies using the import and export options. See the Junos OS VPNs Library for Routing Devices.

8. Configure this routing instance with vrf-table-label, which maps the inner label of a packet to a specific VPN routing and forwarding (VRF) table and allows the examination of the encapsulated IP header:
   [edit routing-instances]
user@switchPE1# set L3VPN-1 vrf-table-label
9. Configure the router ID and autonomous system (AS):

   Note: We recommend that you explicitly configure the router identifier under the [edit routing-options] hierarchy level to avoid unpredictable behavior if the interface address on a loopback interface changes.

   [edit routing-options]
user@switchPE1# set router-id 21.21.21.21 autonomous-system 10

Results

Display the results of the configuration:

Configuring the Remote PE Switch

CLI Quick Configuration

To quickly configure the Layer 3 VPN components on the remote PE switch, copy the following commands and paste them into the switch terminal window of PE2:

Step-by-Step Procedure

1. Configure BGP, specifying the loopback address as the local address and specifying family inet-vpn unicast:
   [edit protocols bgp]
user@switchPE2# set local-address 22.22.22.22 family inet-vpn unicast
2. Configure the BGP group, specifying the group name and type:
   [edit protocols bgp]
user@switchPE2# set group PE1-PE2 type internal
3. Configure the BGP neighbor, specifying the loopback address of the remote PE switch as the neighbor’s address:
   [edit protocols bgp]
user@switchPE2# set neighbor 21.21.21.21
4. Configure the routing instance, specifying the routing-instance name and using vrf as the instance type:
   [edit routing-instances]
user@switchPE2# set L3VPN-1 instance-type vrf
5. Configure a description for this routing instance:
   [edit routing-instances]
user@switchPE1# set L3VPN-1 description "BETWEEN PE1 AND PE2"
6. Configure the routing instance to apply to the customer edge interface:
   [edit routing-instances]
user@switchPE2# set L3VPN-1 interface ge-0/0/14.0
7. Configure the routing instance to use a route distinguisher, using the format ip-address:number:
   [edit routing-instances]
user@switchPE2# set L3VPN-1 route-distinguisher 21:21
8. Configure the VPN routing and forwarding (VRF) target of the routing instance:
   [edit routing-instances]
user@switchPE2# set L3VPN-1 vrf-target target:21:21
9. Configure this routing instance with vrf-table-label, which maps the inner label of a packet to a specific VPN routing and forwarding (VRF) table and allows the examination of the encapsulated IP header.
   [edit routing-instances]
user@switchPE2# set L3VPN-1 vrf-tabel-label
10. Configure the router ID and autonomous system (AS):
    [edit routing-options]
user@switchPE2# set router-id 22.22.22.22 autonomous-system 10

Results

Display the results of the configuration: