Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

SCU with Layer 3 VPNs Configuration

Configuring SCU in a Layer 3 VPN

Figure 1: SCU in a Layer 3 VPN Topology DiagramSCU in a Layer 3 VPN Topology Diagram

Figure 1 displays a Layer 3 VPN topology. CE1 and CE2 are customer edge (CE) routers connected by a VPN through provider routers PE1, P0, and PE2. EBGP is established between routers CE1 and PE1, IBGP connects routers PE1 and PE2 over an IS-IS/MPLS/LDP core, and a second EBGP connection flows between routers PE2 and CE2.

On Router CE1, begin your VPN by setting up an EBGP connection to PE1. Install a static route of 10.114.1.0/24 and advertise this route to your EBGP neighbor.

Router CE1

On PE1, complete the EBGP connection to CE1 through a VRF routing instance. Set an export policy for your VRF instance that puts BGP traffic into a community, and an import policy that accepts like community traffic from your VPN neighbor. Lastly, configure an IBGP relationship to Router PE2 that runs over an IS-IS, MPLS, and LDP core.

Router PE1

On P0, connect the IBGP neighbors located at PE1 and PE2. Remember to include VPN-related protocols (MPLS, LDP, and IGP) on all interfaces.

Router P0

On PE2, complete the IBGP relationship to Router PE1. Establish an EBGP connection to CE2 through a VRF routing instance. Set an export policy for the VRF instance that places BGP traffic into a community, and an import policy that accepts like community traffic from the VPN neighbor. Next, establish a policy that adds the static route from CE1 to a source class called GOLD1. Also, export this SCU policy into the forwarding table. Finally, set your vt interface as the SCU input interface and establish the CE-facing interface so-0/0/0 as the SCU output interface.

Router PE2

On Router CE2, complete the VPN path by finishing the EBGP connection to PE2.

Router CE2

Verifying Your Work

To verify that SCU is functioning properly in the Layer 3 VPN, use the following commands:

  • show interfaces interface-name statistics

  • show interfaces source-class source-class-name interface-name

  • show interfaces interface-name (extensive | detail)

  • show route (extensive | detail)

  • clear interface interface-name statistics

You should always verify SCU statistics at the outbound SCU interface on which you configured the output statement. To check SCU functionality, follow these steps:

  1. Clear all counters on your SCU-enabled router and verify they are empty.

  2. Send a ping from the ingress CE router to the second CE router to generate SCU traffic across the SCU-enabled VPN route.

  3. Verify that the counters are incrementing correctly on the outbound interface.

The following section shows the output of these commands used with the configuration example.