Configure Import Policy for the PE Router's VRF Table

Each VPN can have a policy that defines how routes are imported into the PE router's VRF table. An import policy is applied to routes received from other PE routers in the VPN. A policy must evaluate all routes received over the IBGP session with the peer PE router. If the routes match the conditions, the route is installed in the PE router's routing-instance-name.inet.0 VRF table. An import policy must contain a second term that rejects all other routes.

Unless an import policy contains only a then reject statement, it must include a reference to a community. Otherwise, when you try to commit the configuration, the commit fails. You can configure multiple import policies.

An import policy determines what to import to a specified VRF table based on the VPN routes learned from the remote PE routers through IBGP. The IBGP session is configured at the [edit protocols bgp] hierarchy level. If you also configure an import policy at the [edit protocols bgp] hierarchy level, the import policies at the [edit policy-options] hierarchy level and the [edit protocols bgp] hierarchy level are combined through a logical AND operation. This allows you to filter traffic as a group.

To configure an import policy for the PE router's VRF table, follow these steps:

1. To define an import policy, include the policy-statement statement. For all PE routers, an import policy must always include the following, at a minimum:

[edit]

policy-options {

    policy-statement import-policy-name {

        term import-term-name {

            from {

                protocol bgp;

                community community-id;

            }

            then accept;

        }

        term term-name {

            then reject;

        }

    }

}

You can configure these statements at the following hierarchy levels:

• [edit policy-options]
• [edit logical-routers logical-router-name policy-options]

The import-policy-name policy evaluates all routes received over the IBGP session with the other PE router. If the routes match the conditions in the from statement, the route is installed in the PE router's routing-instance-name.inet.0 VRF table. The second term in the policy rejects all other routes.

For more information about creating policies, see the JUNOS Internet Software Configuration Guide: Policy Framework.

2. To configure an import policy, include the vrf-import statement:

vrf-import import-policy-name;

You can configure this statement at the following hierarchy levels:

• [edit logical-routers logical-router-name routing-instances routing-instance-name]
• [edit routing-instances routing-instance-name]