Example: Configuring Layer 3 VPN Protocol Family Qualifiers for Route Filters

This example uses Junos OS Release 10.0 or later.

Before you begin:

• Configure the device interfaces.

• Configure an interior gateway protocol. See the Junos OS Routing Protocols Library.

• Configure a BGP session for multiple route types. For example, configure the session for both family inet routes and family inet-vpn routes. See Configuring IBGP Sessions Between PE Routers in VPNs and Configuring Layer 3 VPNs to Carry IPv6 Traffic.

Family qualifiers cause a route filter to match only one specific family. When you configure an IPv4 route filter without a family qualifier, as shown here, the route filter matches inet and inet-vpn routes.

route-filter ipv4-address/mask;

Likewise, when you configure an IPv6 route filter without a family qualifier, as shown here, the route filter matches inet6 and inet6-vpn routes.

route-filter ipv6-address/mask;

Consider the case in which a BGP session has been configured for both family inet routes and family inet-vpn routes, and an import policy has been configured for this BGP session. This means that both family inet and family inet-vpn routes, when received, share the same import policy. The policy term might look as follows:

from {
    route-filter 0.0.0.0/0 exact;
}
then {
    next-hop self;
    accept;
}

This route-filter logic matches an inet route of 0.0.0.0 and an inet-vpn route whose IPv4 address portion is 0.0.0.0. The 8-byte route distinguisher portion of the inet-vpn route is not considered in the route-filter matching. This is a change in Junos OS behavior that was introduced in Junos OS Release 10.0.

If you do not want your policy to match both types of routes, add a family qualifier to your policy. To have the route-filter match only inet routes, add the family inet policy qualifier. To have the route-filter match only inet-vpn routes, add the family inet-vpn policy qualifier.

The family qualifier is evaluated before the route-filter is evaluated. Thus, the route-filter is not evaluated if the family match fails. The same logic applies to family inet6 and family inet6-vpn. The route-filter used in the inet6 example must use an IPv6 address. There is a potential efficiency gain in using a family qualifier because the family qualifier is tested before most other qualifiers, quickly eliminating routes from undesired families.

• Procedure
• Results

set policy-options policy-statement specific-family from family inet 
set policy-options policy-statement specific-family from route-filter 0.0.0.0/0 exact 
set policy-options policy-statement specific-family then next-hop self 
set policy-options policy-statement specific-family then accept
set protocols bgp import specific-family

set policy-options policy-statement specific-family from family inet-vpn 
set policy-options policy-statement specific-family from route-filter 0.0.0.0/0 exact 
set policy-options policy-statement specific-family then next-hop self 
set policy-options policy-statement specific-family then accept
set protocols bgp import specific-family

set policy-options policy-statement specific-family from family inet6 
set policy-options policy-statement specific-family from route-filter 0::0/0 exact
set policy-options policy-statement specific-family then next-hop self 
set policy-options policy-statement specific-family then accept
set protocols bgp import specific-family

set policy-options policy-statement specific-family from family inet6-vpn 
set policy-options policy-statement specific-family from route-filter 0::0/0 exact
set policy-options policy-statement specific-family then next-hop self 
set policy-options policy-statement specific-family then accept
set protocols bgp import specific-family

user@host# show protocols
bgp {
    import specific-family;
}
user@host# show policy-options
policy-statement specific-family {
    from {
        family inet;
        route-filter 0.0.0.0/0 exact;
    }
    then {
        next-hop self;
        accept;
    }
}

To verify the configuration, run the following commands:

• show route advertising-protocol bgp neighbor detail

• show route instance instance-name detail