[Contents] [Prev] [Next] [Index] [Report an Error]

Configuring VPN Policy on the PE Routers

You must configure VPN import and export policies on each of the PE routers so that they install the appropriate routes in their VRF tables, which they use to forward packets within a VPN. For VPN-A, the VRF table is VPN-A.inet.0.

In the VPN policy, you also configure VPN target communities.

Note: In this example, a private AS number is used for the route target. This number is used for illustration only. When you are configuring VPNs, you should use an assigned AS number.

On Router PE1, configure the following VPN import and export policies:

Note: The policy qualifiers shown in this example are only those needed for the VPN to function. You can configure additional qualifiers, as needed, to any policies that you configure.



[edit]
policy-options {


policy-statement VPN-A-import {


term a {


from {
protocol bgp;
community VPN-A;
}


then accept;
}




term b {
then reject;
}


}




policy-statement VPN-A-export {


term a {
from protocol rip;


then {
community add VPN-A;
accept;
}


}




term b {
then reject;
}


}


community VPN-A members target:65535:00;
}

On Router PE2, configure the following VPN import and export policies:



[edit]
policy-options {


policy-statement VPN-A-import {


term a {


from {
protocol bgp;
community VPN-A;
}


then accept;
}




term b {
then reject;
}


}




policy-statement VPN-A-export {


term a {
from protocol ospf;


then {
community add VPN-A;
accept;
}


}




term b {
then reject;
}


}


community VPN-A members target:65535:00;
}

To apply the VPN policies on the routers, include the vrf-export and vrf-import statements when you configure the routing instance on the PE routers. The VRF import and export policies handle the route distribution across the IBGP session running between the PE routers.

[Contents] [Prev] [Next] [Index] [Report an Error]