close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Common Configuration for All VPNs
- play_arrow VPNs Overview
- play_arrow Assigning Routing Instances to VPNs
- play_arrow Distributing Routes in VPNs
- play_arrow Distributing VPN Routes with Target Filtering
- play_arrow Configuring Forwarding Options for VPNs
  - Chained Composite Next Hops for VPNs and Layer 2 Circuits
  - Example: Configuring Chained Composite Next Hops for Direct PE-PE Connections in VPNs
- play_arrow Configuring Graceful Restart for VPNs
- play_arrow Configuring Class of Service for VPNs
  - VPNs and Class of Service
  - Rewriting Class of Service Markers and VPNs
- play_arrow Pinging VPNs
play_arrow Common Configuration for Layer 2 VPNs and VPLS
- play_arrow Overview
- play_arrow Layer 2 VPNs Configuration Overview
- play_arrow Configuring Layer 2 Interfaces
- play_arrow Configuring Path Selection for Layer 2 VPNs and VPLS
  - Understanding BGP Path Selection
  - Enabling BGP Path Selection for Layer 2 VPNs and VPLS
- play_arrow Creating Backup Connections with Redundant Pseudowires
  - Redundant Pseudowires for Layer 2 Circuits and VPLS
  - Configuring Redundant Pseudowires for Layer 2 Circuits and VPLS
- play_arrow Configuring Class of Service for Layer 2 VPNs
  - Configuring Traffic Policing in Layer 2 VPNs
- play_arrow Monitoring Layer 2 VPNs
play_arrow Configuring Group VPNs
- play_arrow Configuring Group VPNv2
play_arrow Configuring Public Key Infrastructure
- play_arrow Configuring Digital Certificate Validation
  - Understanding Digital Certificate Validation
  - Example: Improving Digital Certificate Validation by Configuring Policy OIDs on an MX Series Device
- play_arrow Configuring a Device for Certificate Chains
  - IKE Authentication (Certificate-Based Authentication)
  - Example: Configuring a Device for Peer Certificate Chain Validation
- play_arrow Managing Certificate Revocation
  - Online Certificate Status Protocol and Certificate Revocation Lists
  - Example: Improving Security by Configuring OCSP for Certificate Revocation Status
play_arrow Configuring Layer 2 Circuits
- play_arrow Overview
  - Layer 2 Circuit Overview
- play_arrow Layer 2 Circuits Configuration Overview
- play_arrow Configuring Class of Service with Layer 2 Circuits
- play_arrow Configuring Pseudowire Redundancy for Layer 2 Circuits
- play_arrow Configuring Load Balancing for Layer 2 Circuits
  - Reducing APS Switchover Time in Layer 2 Circuits
- play_arrow Configuring Protection Features for Layer 2 Circuits
- play_arrow Monitoring Layer 2 Circuits with BFD
  - Configuring BFD for VCCV for Layer 2 Circuits
  - Example: Configuring BFD for VCCV for Layer 2 Circuits
- play_arrow Troubleshooting Layer 2 Circuits
  - Tracing Layer 2 Circuit Operations
play_arrow Configuring VPWS VPNs
- play_arrow Overview
- play_arrow Configuring VPWS VPNs
play_arrow Configuring VPLS
play_arrow Connecting Layer 2 VPNs and Circuits to Other VPNs
- play_arrow Connecting Layer 2 VPNs to Other VPNs
- play_arrow Connecting Layer 2 Circuits to Other VPNs
play_arrow Configuration Statements and Operational Commands
- Junos CLI Reference Overview

list Table of Contents

English

Configuring the Route Origin for VPNs

date_range 23-Nov-23

arrow_backward

arrow_forward

You can use route origin to prevent routes learned from one customer edge (CE) router marked with origin community from being advertised back to it from another CE router in the same AS.

In the example, the route origin is used to prevent routes learned from CE Router A that are marked with origin community from being advertised back to CE Router E by AS 200. The example topology is shown in Figure 1.

Figure 1: Network Topology of Site of Origin Example

In this topology, CE Router A and CE Router E are in the same AS (AS200). They use EBGP to exchange routes with their respective provider edge (PE) routers, PE Router B and PE Router D. The two CE routers have a back connection.

The following sections describe how to configure the route origin for a group of VPNs:

Configuring the Site of Origin Community on CE Router A

The following section describes how to configure CE Router A to advertise routes with a site of origin community to PE Router B for this example.

Note:

In this example, direct routes are configured to be advertised, but any route can be configured.

Configure a policy to advertise routes with my-soo community on CE Router A as follows:

content_copy zoom_out_map
[edit]
policy-options {
    policy-statement export-to-my-isp {
        term a {
            from {
                protocol direct;
            }
            then {
                community add my-soo;
                accept;
            }
        }
    }
}

Configuring the Community on CE Router A

Configure the my-soo community on CE Router A as follows:

content_copy zoom_out_map
[edit]
policy-options {
    community my-soo {
        members origin:100:1;
    }
}

Applying the Policy Statement on CE Router A

Apply the export-to-my-isp policy statement as an export policy to the EBGP peering on the CE Router A as follows:

content_copy zoom_out_map
[edit]
protocols {
    bgp {
        group my_isp {
            export export-to-my-isp;
        }
    }
}

When you issue the show route receive-protocol bgp detail command, you should see the following routes originated from PE Router B with my-soo community:

content_copy zoom_out_map
user@host> show route receive-protocol bgp 10.12.99.2 detail
inet.0: 16 destinations, 16 routes (15 active, 0 holddown, 1 hidden)
inet.3: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
vpn_blue.inet.0: 8 destinations, 10 routes (8 active, 0 holddown, 0 hidden)
* 10.12.33.0/30 (2 entries, 1 announced)
     Nexthop: 10.12.99.2
     AS path: 100 I
     Communities: origin:100:1
  10.12.99.0/30 (2 entries, 1 announced)
     Nexthop: 10.12.99.2
     AS path: 100 I
     Communities: origin:100:1
* 10.255.71.177/32 (1 entry, 1 announced)
     Nexthop: 10.12.99.2
     AS path: 100 I
     Communities: origin:100:1
* 192.168.64.0/21 (1 entry, 1 announced)
     Nexthop: 10.12.99.2
     AS path: 100 I
     Communities: origin:100:1
iso.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
mpls.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
bgp.l3vpn.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden)
inet6.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
__juniper_private1__.inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 
hidden)

Configuring the Policy on PE Router D

Configure a policy on PE Router D that prevents routes with my-soo community tagged by CE Router A from being advertised to CE Router E as follows:

content_copy zoom_out_map
[edit]
policy-options {
    policy-statement soo-ce1-policy {
        term a {
            from {
                community my-soo;
                then {
                    reject;
                }
            }
        }
    }
}

Configuring the Community on PE Router D

Configure the community on PE Router D as follows:

content_copy zoom_out_map
[edit]
policy-options {
    community my-soo {
        members origin:100:1;
    }
}

Applying the Policy on PE Router D

To prevent routes learned from CE Router A from being advertised to CE Router E (the two routers can communicate these routes directly), apply the soo-ce1-policy policy statement as an export policy to the PE Router D and CE Router E EBGP session vpn_blue.

View the EBGP session on PE Router D using the show routing-instances command.

content_copy zoom_out_map
user@host# show routing-instances
vpn_blue {
    instance-type vrf;
    interface fe-2/0/0.0;
    vrf-target target:100:200;
    protocols {
        bgp {
            group ce2 {
                advertise-peer-as;
                peer-as 100;
                neighbor 10.12.99.6;
            }
        }
    }
}

Apply the soo-ce1-policy policy statement as an export policy to the PE Router D and CE Router E EBGP session vpn_blue as follows:

content_copy zoom_out_map
[edit routing-instances]
vpn_blue {
    protocols {
        bgp {
            group ce2{
                export soo-ce1-policy;
            }
        }
    }
}

arrow_backward PREVIOUS Configuring Policies for the VRF Table on PE Routers in VPNs

NEXT arrow_forward Configuring BGP Route Target Filtering for VPNs

Layer 2 VPNs and VPLS User Guide for Routing Devices

ON THIS PAGE