Navigation
Table of Contents
Guide That Contains This Content
[+] Expand All
[-] Collapse All
Related Documentation
- ACX Series
- Centralized Internet Access
- Configuring Hub-and-Spoke VPN Topologies: One Interface
- Configuring Hub-and-Spoke VPN Topologies: Two Interfaces
- Configuring Overlapping VPNs Using Automatic Route Export
- Configuring Overlapping VPNs Using Routing Table Groups
- Configuring a Simple Full-Mesh VPN Topology
- Configuring an Application-Based Layer 3 VPN Topology
- Configuring an LDP-over-RSVP VPN Topology
- Configuring an OSPF Domain ID for a Layer 3 VPN
- Distributed Internet Access
- Routing Internet Traffic Through a Separate NAT Device
- Routing VPN and Internet Traffic Through Different Interfaces
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Private Addresses)
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Public Addresses)
- Routing VPN and Outgoing Internet Traffic Through the Same Interface and Routing Return Internet Traffic Through a Different Interface
- M Series
- Centralized Internet Access
- Configuring Hub-and-Spoke VPN Topologies: One Interface
- Configuring Hub-and-Spoke VPN Topologies: Two Interfaces
- Configuring Overlapping VPNs Using Automatic Route Export
- Configuring Overlapping VPNs Using Routing Table Groups
- Configuring a Full-Mesh VPN Topology with Route Reflectors
- Configuring a GRE Tunnel Interface Between PE Routers
- Configuring a GRE Tunnel Interface Between a PE and CE Router
- Configuring a Simple Full-Mesh VPN Topology
- Configuring an Application-Based Layer 3 VPN Topology
- Configuring an ES Tunnel Interface Between a PE and CE Router
- Configuring an LDP-over-RSVP VPN Topology
- Configuring an OSPF Domain ID for a Layer 3 VPN
- Distributed Internet Access
- Routing Internet Traffic Through a Separate NAT Device
- Routing VPN and Internet Traffic Through Different Interfaces
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Private Addresses)
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Public Addresses)
- Routing VPN and Outgoing Internet Traffic Through the Same Interface and Routing Return Internet Traffic Through a Different Interface
- Setting the Forwarding Class of the Ping Packets
- MX Series
- Centralized Internet Access
- Configuring Hub-and-Spoke VPN Topologies: One Interface
- Configuring Hub-and-Spoke VPN Topologies: Two Interfaces
- Configuring Overlapping VPNs Using Automatic Route Export
- Configuring Overlapping VPNs Using Routing Table Groups
- Configuring a Full-Mesh VPN Topology with Route Reflectors
- Configuring a GRE Tunnel Interface Between PE Routers
- Configuring a GRE Tunnel Interface Between a PE and CE Router
- Configuring a Simple Full-Mesh VPN Topology
- Configuring an Application-Based Layer 3 VPN Topology
- Configuring an ES Tunnel Interface Between a PE and CE Router
- Configuring an LDP-over-RSVP VPN Topology
- Configuring an OSPF Domain ID for a Layer 3 VPN
- Distributed Internet Access
- Routing Internet Traffic Through a Separate NAT Device
- Routing VPN and Internet Traffic Through Different Interfaces
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Public Addresses)
- Routing VPN and Outgoing Internet Traffic Through the Same Interface and Routing Return Internet Traffic Through a Different Interface
- PTX Series
- Centralized Internet Access
- Configuring Hub-and-Spoke VPN Topologies: One Interface
- Configuring Hub-and-Spoke VPN Topologies: Two Interfaces
- Configuring Overlapping VPNs Using Automatic Route Export
- Configuring Overlapping VPNs Using Routing Table Groups
- Configuring a Full-Mesh VPN Topology with Route Reflectors
- Configuring a Simple Full-Mesh VPN Topology
- Configuring an LDP-over-RSVP VPN Topology
- Distributed Internet Access
- Routing VPN and Internet Traffic Through Different Interfaces
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Private Addresses)
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Public Addresses)
- Routing VPN and Outgoing Internet Traffic Through the Same Interface and Routing Return Internet Traffic Through a Different Interface
- T Series
- Centralized Internet Access
- Configuring Hub-and-Spoke VPN Topologies: One Interface
- Configuring Hub-and-Spoke VPN Topologies: Two Interfaces
- Configuring Overlapping VPNs Using Automatic Route Export
- Configuring Overlapping VPNs Using Routing Table Groups
- Configuring a Full-Mesh VPN Topology with Route Reflectors
- Configuring a GRE Tunnel Interface Between PE Routers
- Configuring a GRE Tunnel Interface Between a PE and CE Router
- Configuring a Simple Full-Mesh VPN Topology
- Configuring an Application-Based Layer 3 VPN Topology
- Configuring an ES Tunnel Interface Between a PE and CE Router
- Configuring an LDP-over-RSVP VPN Topology
- Configuring an OSPF Domain ID for a Layer 3 VPN
- Distributed Internet Access
- Routing Internet Traffic Through a Separate NAT Device
- Routing VPN and Internet Traffic Through Different Interfaces
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Private Addresses)
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Public Addresses)
- Routing VPN and Outgoing Internet Traffic Through the Same Interface and Routing Return Internet Traffic Through a Different Interface
- Setting the Forwarding Class of the Ping Packets
Introduction to Configuring Layer 3 VPNs
To configure Layer 3 virtual private network (VPN) functionality, you must enable VPN support on the provider edge (PE) router. You must also configure any provider (P) routers that service the VPN, and you must configure the customer edge (CE) routers so that their routes are distributed into the VPN.
To configure Layer 3 VPNs, you include the following statements:
description text;instance-type vrf;interface interface-name;
protocols {bgp {group group-name {peer-as as-number;neighbor ip-address;}multihop ttl-value;}(ospf | ospf3) {area area {interface interface-name;}domain-id domain-id;domain-vpn-tag number;sham-link {local address;}sham-link-remote address <metric number>;}rip {rip-configuration;}}
route-distinguisher (as-number:id | ip-address:id);router-id address;routing-options {autonomous-system autonomous-system {independent-domain;loops number;}forwarding-table {export [ policy-names ];}interface-routes {rib-group group-name;}martians {destination-prefix match-type <allow>; }maximum-paths {path-limit;log-interval interval;log-only;threshold percentage;}maximum-prefixes {prefix-limit;log-interval interval;log-only;threshold percentage;}multipath {vpn-unequal-cost;}options {syslog (level level | upto level);}rib routing-table-name {martians {destination-prefix match-type <allow>; }multipath {vpn-unequal-cost;}static {defaults {static-options;}route destination-prefix {next-hop [next-hops]; static-options; }}}}
static {defaults {static-options;}route destination-prefix {policy [ policy-names ];static-options;}}
vrf-advertise-selective {family {inet-mvpn;inet6-mvpn;}}
vrf-export [ policy-names ];vrf-import [ policy-names ];vrf-target (community | export community-name | import community-name);vrf-table-label;You can include these statements at the following hierarchy levels:
- [edit routing-instances routing-instance-name]
- [edit logical-systems logical-system-name routing-instances routing-instance-name]
For Layer 3 VPNs, only some of the statements in the [edit routing-instances] hierarchy are valid. For the full hierarchy, see the Junos OS Routing Protocols Library for Routing Devices.
In addition to these statements, you must enable a signaling protocol, IBGP sessions between the PE routers, and an interior gateway protocol (IGP) on the PE and P routers.
By default, Layer 3 VPNs are disabled.
Many of the configuration procedures for Layer 3 VPNs are common to all types of VPNs.
Related Documentation
- ACX Series
- Centralized Internet Access
- Configuring Hub-and-Spoke VPN Topologies: One Interface
- Configuring Hub-and-Spoke VPN Topologies: Two Interfaces
- Configuring Overlapping VPNs Using Automatic Route Export
- Configuring Overlapping VPNs Using Routing Table Groups
- Configuring a Simple Full-Mesh VPN Topology
- Configuring an Application-Based Layer 3 VPN Topology
- Configuring an LDP-over-RSVP VPN Topology
- Configuring an OSPF Domain ID for a Layer 3 VPN
- Distributed Internet Access
- Routing Internet Traffic Through a Separate NAT Device
- Routing VPN and Internet Traffic Through Different Interfaces
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Private Addresses)
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Public Addresses)
- Routing VPN and Outgoing Internet Traffic Through the Same Interface and Routing Return Internet Traffic Through a Different Interface
- M Series
- Centralized Internet Access
- Configuring Hub-and-Spoke VPN Topologies: One Interface
- Configuring Hub-and-Spoke VPN Topologies: Two Interfaces
- Configuring Overlapping VPNs Using Automatic Route Export
- Configuring Overlapping VPNs Using Routing Table Groups
- Configuring a Full-Mesh VPN Topology with Route Reflectors
- Configuring a GRE Tunnel Interface Between PE Routers
- Configuring a GRE Tunnel Interface Between a PE and CE Router
- Configuring a Simple Full-Mesh VPN Topology
- Configuring an Application-Based Layer 3 VPN Topology
- Configuring an ES Tunnel Interface Between a PE and CE Router
- Configuring an LDP-over-RSVP VPN Topology
- Configuring an OSPF Domain ID for a Layer 3 VPN
- Distributed Internet Access
- Routing Internet Traffic Through a Separate NAT Device
- Routing VPN and Internet Traffic Through Different Interfaces
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Private Addresses)
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Public Addresses)
- Routing VPN and Outgoing Internet Traffic Through the Same Interface and Routing Return Internet Traffic Through a Different Interface
- Setting the Forwarding Class of the Ping Packets
- MX Series
- Centralized Internet Access
- Configuring Hub-and-Spoke VPN Topologies: One Interface
- Configuring Hub-and-Spoke VPN Topologies: Two Interfaces
- Configuring Overlapping VPNs Using Automatic Route Export
- Configuring Overlapping VPNs Using Routing Table Groups
- Configuring a Full-Mesh VPN Topology with Route Reflectors
- Configuring a GRE Tunnel Interface Between PE Routers
- Configuring a GRE Tunnel Interface Between a PE and CE Router
- Configuring a Simple Full-Mesh VPN Topology
- Configuring an Application-Based Layer 3 VPN Topology
- Configuring an ES Tunnel Interface Between a PE and CE Router
- Configuring an LDP-over-RSVP VPN Topology
- Configuring an OSPF Domain ID for a Layer 3 VPN
- Distributed Internet Access
- Routing Internet Traffic Through a Separate NAT Device
- Routing VPN and Internet Traffic Through Different Interfaces
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Public Addresses)
- Routing VPN and Outgoing Internet Traffic Through the Same Interface and Routing Return Internet Traffic Through a Different Interface
- PTX Series
- Centralized Internet Access
- Configuring Hub-and-Spoke VPN Topologies: One Interface
- Configuring Hub-and-Spoke VPN Topologies: Two Interfaces
- Configuring Overlapping VPNs Using Automatic Route Export
- Configuring Overlapping VPNs Using Routing Table Groups
- Configuring a Full-Mesh VPN Topology with Route Reflectors
- Configuring a Simple Full-Mesh VPN Topology
- Configuring an LDP-over-RSVP VPN Topology
- Distributed Internet Access
- Routing VPN and Internet Traffic Through Different Interfaces
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Private Addresses)
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Public Addresses)
- Routing VPN and Outgoing Internet Traffic Through the Same Interface and Routing Return Internet Traffic Through a Different Interface
- T Series
- Centralized Internet Access
- Configuring Hub-and-Spoke VPN Topologies: One Interface
- Configuring Hub-and-Spoke VPN Topologies: Two Interfaces
- Configuring Overlapping VPNs Using Automatic Route Export
- Configuring Overlapping VPNs Using Routing Table Groups
- Configuring a Full-Mesh VPN Topology with Route Reflectors
- Configuring a GRE Tunnel Interface Between PE Routers
- Configuring a GRE Tunnel Interface Between a PE and CE Router
- Configuring a Simple Full-Mesh VPN Topology
- Configuring an Application-Based Layer 3 VPN Topology
- Configuring an ES Tunnel Interface Between a PE and CE Router
- Configuring an LDP-over-RSVP VPN Topology
- Configuring an OSPF Domain ID for a Layer 3 VPN
- Distributed Internet Access
- Routing Internet Traffic Through a Separate NAT Device
- Routing VPN and Internet Traffic Through Different Interfaces
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Private Addresses)
- Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Public Addresses)
- Routing VPN and Outgoing Internet Traffic Through the Same Interface and Routing Return Internet Traffic Through a Different Interface
- Setting the Forwarding Class of the Ping Packets
