[Contents] [Prev] [Next] [Index] [Report an Error]

Configuration on Router A

On Router A, you configure the interface to Clients A, B, and C. The configuration evaluates incoming traffic to determine whether it is to be forwarded by means of VPN or standard destination-based routing.

First, you apply an inbound filter and configure the interface:



[edit]
interfaces { 


fe-1/1/0 {


unit 0 {


family inet {


filter {
input fbf-vrf;
}


address 192.168.1.1/24;
}


}


}


}

Because the interfaces that use filter-based forwarding must not be bound to a VPN, you must configure an alternate method to provide next-hop routes to the VRF table. You do this by defining an interface routing table group and sharing this group among all the routing tables:



[edit]
routing-options {


interface-routes {
rib-group inet if-rib;
}




rib-groups {


if-rib {
import-rib [ inet.0 vpn-A.inet.0 vpn-B.inet.0 ];
}


}


}

You apply the following filter to incoming traffic on interface fe-1/1/0.0. The first term matches traffic from Client A and forwards it to the routing instance for VPN A. The second term matches traffic from Client B that is destined for Client D and forwards it to the routing instance for VPN B. The third term matches all other traffic, which is forwarded normally by means of destination-based forwarding according to the routes in inet.0.



[edit firewall family family-name]
filter fbf-vrf {


term vpnA {


from {


source-address {
192.168.1.1/32;
}


}




then {
routing-instance vpn-A;
}


}




term vpnB {


from {


source-address {
192.168.1.2/32;
}




destination-address {
192.168.3.0/24;
}


}


then routing-instance vpn-B;
}


}
term internet {
then accept;
}

You then configure the routing instances for VPN A and VPN B. Notice that these statements include all the required statements to define a Layer 3 VPN except for the interface statement.



[edit]
routing-instances {


vpn-A {
instance-type vrf;
route-distinguisher 172.21.10.63:100;
vrf-import vpn-A-import;
vrf-export vpn-A-export;
}




vpn-B {
instance-type vrf;
route-distinguisher 172.21.10.63:200;
vrf-import vpn-B-import;
vrf-export vpn-B-export;
}


}

[Contents] [Prev] [Next] [Index] [Report an Error]