[Contents] [Prev] [Next] [Index] [Report an Error]

Configuring VPN Policy on the PE Routers

Configure the VPN import and export policies on each PE router so that the appropriate routes are installed in the PE router’s VRF tables. The VRF table is used to forward packets within a VPN. For VPN-A, the VRF table is VPN-A.inet.0, and for VPN-B it is VPN-B.inet.0.

In the VPN policy, you also configure VPN target communities.

Note: In this example, a private AS number is used for the route target. This number is used for illustration only. When you are configuring VPNs, you should use an assigned AS number.

On PE Router A, configure the following VPN import and export policies:

Note: The policy qualifiers shown in this example are only those needed for the VPN to function. You can configure additional qualifiers, as needed, to any policies that you configure.



[edit]
policy-options {


policy-statement VPN-A-import {


term a {


from {
protocol bgp;
community VPN-A;
}


then accept;
}




term b {
then reject;
}


}




policy-statement VPN-A-export {


term a {
from protocol static;


then {
community add VPN-A;
accept;
}


}




term b {
then reject;
}


}




policy-statement VPN-B-import {


term a {


from {
protocol bgp;
community VPN-B;
}


then accept;
}




term b {
then reject;
}


}




policy-statement VPN-B-export {


term a {
from protocol ospf; 


then {
community add VPN-B;
accept;
}


}




term b {
then reject;
}


}


community VPN-A members target:65535:4;
community VPN-B members target:65535:5;
}

On PE Router C, configure the following VPN import and export policies:



[edit]
policy-options {


policy-statement VPN-A-import {


term a {


from {
protocol bgp;
community VPN-A;
}


then accept;
}




term b {
then reject;
}


}




policy-statement VPN-A-export {


term a {
from protocol bgp;


then {
community add VPN-A;
accept;
}


}




term b {
then reject;
}


}




policy-statement VPN-B-import {


term a {


from {
protocol bgp;
community VPN-B;
}


then accept;
}




term b {
then reject;
}


}




policy-statement VPN-B-export {


term a {
from protocol rip; 


then {
community add VPN-B;
accept;
}


}




term b {
then reject;
}


}


community VPN-A members target:65535:4;
community VPN-B members target:65535:5;
}

To apply the VPN policies on the routers, include the vrf-export and vrf-import statements when you configure the routing instance. For both VPNs, the VRF import and export policies handle the route distribution across the IBGP session running between the PE routers.

To apply the VPN policies on PE Router A, include the following statements:



[edit]
routing-instance {


VPN-A-Paris-Munich {
vrf-import VPN-A-import;
vrf-export VPN-A-export;
}




VPN-B-Madrid {
vrf-import VPN-B-import;
vrf-export VPN-B-export;
}


}

To apply the VPN policies on PE Router C, include the following statements:



[edit]
routing-instance {


VPN-A-Tokyo {
vrf-import VPN-A-import;
vrf-export VPN-A-export;
}




VPN-B-Osaka {
vrf-import VPN-B-import;
vrf-export VPN-B-export;
}


}

[Contents] [Prev] [Next] [Index] [Report an Error]