[Contents] [Prev] [Next] [Index] [Report an Error] [No Frames]

JUNOSe 9.1.x BGP and MPLS Configuration Guide > Configuring BGP-MPLS Applications > Providing Internet Access to and from VPNs

Providing Internet Access to and from VPNs

Normally, hosts in a VPN cannot communicate with hosts in the Internet because the routing table in a VRF contains only routes to sites in the VPN and not routes to sites in the Internet. The exchange of traffic between a VPN and the Internet requires both of the following:

The most common, and simplest, method for providing Internet access is to configure two separate logical circuits. One logical circuit runs between the CE router and the VRF and is used for VPN traffic. The other logical circuit runs between the CE router and the parent VR of the VRF and is used for Internet traffic. These logical circuits are typically FR circuits, ATM circuits, or VLANs.

The following sections describe alternative methods of providing Internet access for situations in which having two separate logical circuits is not acceptable or desirable.

Enabling Traffic Flow from the VPN to the Internet

Traffic from a CE router arrives on a PE interface that exists in the context of a VRF. The PE router then looks up the destination address of the IP packet in the context of the VRF routing table rather than the VR routing table.

Problems

The VRF routing table lookup introduces the following complication.

Solutions

The following methods enable advertising of Internet routes to VPN sites and thus enable traffic flow from the VPNs to the Internet:

You can create multiple IP interfaces on top of a single layer 2 interface. One of those interfaces is the primary IP interface for receiving and sending IP packets. The other interfaces are shared IP interfaces that are used only to send traffic.

Configuring a Default Route to a Shared Interface

For the first solution you create a default route in the VRF that points to a shared IP interface. You must manually create the shared IP interface on top of the layer 2 interface that points to the Internet gateway. See Figure 100.

The main disadvantage of this approach is that if multiple Internet gateways are available, BGP cannot select the egress gateway that is optimal for each destination prefix. Because BGP has only a default route in the VRF, it has to point that single default route to a single uplink interface. All the Internet-bound traffic must flow out of that interface.

You cannot configure traffic for one prefix to flow out of one uplink interface and traffic to another prefix to flow out of another uplink interface. That behavior requires a full default-free Internet routing table in the VRF, which is a complication that you want to avoid.


Figure 100: Static Default Route for Internet Access

The following commands illustrate how to create a shared IP interface in the VRF and point a default route to it:

host1(config)#virtual-router pe1:pe11

host1:pe1:pe11(config)#interface ip internet-access

host1:pe1:pe11(config-if)#ip share-interface atm2/1.3

host1:pe1:pe11(config-if)#ip address 10.1.1.3 255.255.255.255

host1:pe1:pe11(config-if)#exit

host1:pe1:pe11(config)#ip route 0.0.0.0 0.0.0.0 ip internet-access

See JUNOSe IP, IPv6, and IGP Configuration Guide, Chapter 1, Configuring IP, for information about shared IP interfaces and default routes.

Configuring a Fallback Global Option

For the second solution you use the fallback global option on the PE–CE IP interface (Figure 101). If you have configured this option, the PE router simultaneous performs two different lookups when a packet arrives from the CE router. One lookup is in the IP routing table of the VRF; the other lookup is in the IP routing table of the parent VR.


Figure 101: Fallback Global Option

If BGP finds a route in the VRF context, it uses that route. If BGP does not find a route in the VRF context but does find a route in the VR context, it falls back on the global route in the parent VR. BGP drops the packet if it does not find a route in either context.

To enable fallback global on a PE-CE IP interface:

host1:pe1(config)#interface atm2/0.11

host1:pe1(config-if)#ip vrf forwarding pe11 fallback global

host1:pe1:pe11(config-if)#atm pvc 11 0 11 aal5snap

host1:pe1:pe11(config-if)#ip address 10.11.11.1 255.255.255.0

host1:pe1:pe11(config-if)#exit

See Defining Secondary Routing Table Lookup for more information.

Configuring a Global Import Map for Specific Routes

For the third solution you create a global import map to import only the specific routes needed to reach the desired small number of networks in the Internet. See Figure 102.


Figure 102: Global Import Map Applied to Routes Imported from VRF BGP RIB

The global import map enables global BGP routes to be automatically imported into the BGP RIB table in a VRF. The route map determines which routes are imported and which are not. When they are installed in the VRF routing table, the imported routes point to IP interfaces in the parent virtual router.

To configure a route map and global import map for importing specific routes.

host1(config)#virtual-router pe1

host1:pe1(config)#prefix-list internet-host permit 10.5.5.5/32

host1:pe1(config)#route-map globimap1

host1:pe1(config-route-map)#match ip address prefix-list internethost

host1:pe1(config-route-map)#exit

host1:pe1(config)#ip vrf pe11

host1:pe1(config-vrf)#rd 100:1

host1:pe1(config-vrf)#route-target both 100:1

host1:pe1(config-vrf)#global import map globimap1

Creating a BGP Session Between the CE Router and the Parent VR

The fallback global option enables traffic that arrives at a VRF from the CE router to be sent out on the uplink determined to be optimal by using the full Internet routing table present in the parent VR.

If a CE router is multihomed to multiple PE routers, it must receive a full Internet routing table from each of the PE routers so that the CE router can determine which of the PE routers is optimal for a given Internet prefix.

You can easily create a BGP session from the VRF to the CE router to advertise routes in the VRF to the CE router. However, doing this is insufficient because the VRF does not contain the full Internet routing table, which is present only in the parent VR.

This situation requires a BGP session from the parent VR to the CE router (Figure 103). This BGP session in turn requires a route in the VRF to the loopback interface in the parent VR that is used for BGP peering with the CE router. To achieve this configuration, you must do both of the following:

  1. In the parent VR, create a shared IP interface for the PE-CE interface and point a static route to the loopback of the CE router to the shared interface.
  2. Use a global import map in the VRF to import into the VRF the route to the loopback interface in the parent VR.

Figure 103: BGP Session Between CE Router and Parent VR

The following commands configure a shared IP interface in the parent VR and point a static route for the loopback in the CE router to it:

host1(config)#virtual-router pe1

host1:pe1(config)#interface ip ce1-cust

host1:pe1(config-if)#ip share-interface atm2/0.1

host1:pe1(config-if)#ip address 10.1.1.3 255.255.255.255

host1:pe1(config-if)#exit

host1:pe1(config)#ip route 10.4.4.4 255.255.255.255 ip ce1-cust

The following commands make the loopback in the parent VR reachable from the VRF by means of a global import map:

host1(config)#virtual-router pe1

host1:pe1(config)#prefix-list VRloop permit 10.2.2.2/32

host1:pe1(config)#route-map globimaploop

host1:pe1(config-route-map)#match ip address prefix-list VRloop

host1:pe1(config-route-map)#exit

host1:pe1(config)#ip vrf pe11

host1:pe1(config-vrf)#rd 100:1

host1:pe1(config-vrf)#route-target both 100:1

host1:pe1(config-vrf)#global import map globimaploop

The following commands create a BGP session between the CE router and the parent VR.

On host 1, VR PE 1:

host1(config)#virtual-router pe1

host1:pe1(config)#router bgp 100

host1:pe1(config-router)#neighbor 10.4.4.4 remote-as 200

host1:pe1(config-router)# neighbor 10.4.4.4 ebgp-multihop

host1:pe1(config-router)#neighbor 10.4.4.4 update-source loopback1

host1:pe1(config-router)#exit

On host 2, VR CE 1:

host2(config)#virtual-router ce1

host2:ce1(config)#interface loopback 1

host2:ce1(config-if)#ip address 10.4.4.4 255.255.255.255

host2:ce1(config-if)#exit

host2:ce1(config)#ip route 10.2.2.2 255.255.255.255 atm2/1.1

host2:ce1(config)#router bgp 200

host2:ce1(config-router)#neighbor 10.2.2.2 remote-as 100

host2:ce1(config-router)#neighbor 10.2.2.2 ebgp-multihop

host2:ce1(config-router)#neighbor 10.2.2.2 update-source loopback1

host2:ce1(config-router)#exit

You must also configure either fallback global or a default route to a manually created shared interface in the VRF. See Configuring a Fallback Global Option or Configuring a Default Route to a Shared Interface for details.

You can use the BGP session between the CE router and the parent VR to enable the CE router to advertise prefixes within the VPN site that can be reachable from the global Internet. An alternative configuration is to use a global export map as described in Setting Import and Export Maps for a VRF.

Enabling Traffic Flow from the Internet to the VPN

When traffic flows from the Internet to a VPN, the traffic arrives at the PE router on an interface in the global context. BGP performs a lookup in the global IP routing table, which normally does not contain VPN routes. You can use one of the following methods to advertise public VPN routes to the Internet (get the routes into the global routing table) and thus enable traffic flow from the Internet to those VPNS.

Static Routes to a Shared IP Interface

You can introduce routes to VPN sites into the global routing table by placing static routes to the VPN sites into the global table. The static routes must point to shared IP interfaces that are shares of the PE-CE interface for each particular VPN site. The static routes must then be injected into BGP (possibly as part of an aggregate) so that they can be reached from the Internet. Figure 104 illustrates this approach:


Figure 104: Static Route to Shared IP Interface

The following commands configure the shared interface and a static route:

host1(config)#virtual-router pe1

host1:pe1(config)#interface ip ce1-cust

host1:pe1(config-if)#ip share-interface atm2/0.1

host1:pe1(config-if)# ip address 10.1.1.3 255.255.255.0

host1:pe1(config-if)#exit

host1:pe1(config)#ip route 10.4.4.4 255.255.255.255 ip ce1-cust

Global Export Map

The global export map enables VPN routes to be automatically exported from the BGP RIB table in a VRF to the global BGP RIB table (the BGP RIB table of the parent VR) based on policy. A route map determines which routes are exported and which are not.

When they are installed in the global IP routing table, these exported routes point to the IP interface in the VRF as shown in Figure 105. See Global Export Maps for more information.


Figure 105: Global Export Map Applied to Routes Exported from VRF BGP RIB

The following commands configure the route map and global export map:

host1(config)#virtual-router pe1

host1:pe1(config)#access-list dot-one permit 0.0.0.1 255.255.255.0

host1:pe1(config)#route-map globxmap1

host1:pe1(config-route-map)#match ip address dot-one

host1:pe1(config-route-map)#set local-pref 200

host1:pe1(config-route-map)#exit

host1:pe1(config)#ip vrf pe11

host1:pe1(config-vrf)#rd 100:1

host1:pe1(config-vrf)# route-target both 100:1

host1:pe1(config-vrf)#global export map globxmap1

host1:pe1(config-vrf)#exit
[Contents] [Prev] [Next] [Index] [Report an Error] [No Frames]