[Contents] [Prev] [Next] [Index] [Report an Error]

Configuring VPN Policy on the PE Routers

You must configure VPN import and export policies on each of the PE routers so that they install the appropriate routes in their VRF tables, which the routers use to forward packets within the VPN.

Note: Use the community add statement at the [edit policy-options policy statement term] hierarchy level to facilitate Layer 2 VPN VRF export policies.

On Router A, configure the following VPN import and export policies:



[edit]
policy-options {


policy-statement match-all {


term acceptable {
then accept;
}


}




policy-statement vpn-SPA-export {


term a {


then {
community add SPA-com;
accept;
}


}




term b {
then reject;
}


}




policy-statement vpn-SPA-import {


term a {


from {
protocol bgp;
community SPA-com;
}


then accept;
}




term b {
then reject;
}


}


community SPA-com members target:69:100;
}

On Router B, configure the following VPN import and export policies:



[edit]
policy-options {


policy-statement match-all {


term acceptable {
then accept;
}


}




policy-statement vpn-SPA-import {


term a {


from {
protocol bgp;
community SPA-com;
}


then accept;
}




term b {
then reject;
}


}




policy-statement vpn-SPA-export {


term a {


then {
community add SPA-com;
accept;
}


}




term b {
then reject;
}


}


community SPA-com members target:69:100;
}

On Router C, configure the following VPN import and export policies:



[edit]
policy-options {


policy-statement match-all {


term acceptable {
then accept;
}


}




policy-statement vpn-SPA-import {


term a {


from {
protocol bgp;
community SPA-com;
}


then accept;
}




term b {
then reject;
}


}




policy-statement vpn-SPA-export {


term a {


then {
community add SPA-com;
accept;
}


}




term b {
then reject;
}


}


community SPA-com members target:69:100;
}

To apply the VPN policies on the routers, include the vrf-export and vrf-import statements when you configure the routing instance. The VRF import and export policies handle the route distribution across the IBGP session running between the PE routers.

To apply the VPN policies on Router A, include the following statements:



[edit]
routing-instances {


VPN-Sunnyvale-Portland-Austin {
vrf-import vpn-SPA-import;
vrf-export vpn-SPA-export;
}


}

To apply the VPN policies on Router B, include the following statements:



[edit]
routing-instances {


VPN-Sunnyvale-Portland-Austin {
vrf-import vpn-SPA-import;
vrf-export vpn-SPA-export;
}


}

To apply the VPN policies on Router C, include the following statements:



[edit]
routing-instances {


VPN-Sunnyvale-Portland-Austin {
vrf-import vpn-SPA-import;
vrf-export vpn-SPA-export;
}


}

[Contents] [Prev] [Next] [Index] [Report an Error]