• Supported Platforms
• M Series
• T Series

• Related Topics
• Centralized Internet Access
• Configuring Hub-and-Spoke VPN Topologies: One Interface
• Configuring Hub-and-Spoke VPN Topologies: Two Interfaces
• Configuring Overlapping VPNs Using Automatic Route Export
• Configuring Overlapping VPNs Using Routing Table Groups
• Configuring a Full-Mesh VPN Topology with Route Reflectors
• Configuring a GRE Tunnel Interface Between PE Routers
• Configuring a GRE Tunnel Interface Between a PE and CE Router
• Configuring a Simple Full-Mesh VPN Topology
• Configuring an Application-Based Layer 3 VPN Topology
• Configuring an ES Tunnel Interface Between a PE and CE Router
• Configuring an LDP-over-RSVP VPN Topology
• Configuring an OSPF Domain ID for a Layer 3 VPN
• Distributed Internet Access
• Routing Internet Traffic Through a Separate NAT Device
• Routing VPN and Internet Traffic Through Different Interfaces
• Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Private Addresses)
• Routing VPN and Internet Traffic Through the Same Interface Bidirectionally (VPN Has Public Addresses)
• Routing VPN and Outgoing Internet Traffic Through the Same Interface and Routing Return Internet Traffic Through a Different Interface
• Setting the Forwarding Class of the Ping Packets

Introduction to Configuring Layer 3 VPNs

To configure Layer 3 virtual private network (VPN) functionality, you must enable VPN support on the provider edge (PE) router. You must also configure any provider (P) routers that service the VPN, and you must configure the customer edge (CE) routers so that their routes are distributed into the VPN.

To configure Layer 3 VPNs, you include the following statements:

You can include these statements at the following hierarchy levels:

• [edit routing-instances routing-instance-name]
• [edit logical-systems logical-system-name routing-instances routing-instance-name]

For Layer 3 VPNs, only some of the statements in the [edit routing-instances] hierarchy are valid. For the full hierarchy, see the Junos Routing Protocols Configuration Guide.

In addition to these statements, you must enable a signaling protocol, IBGP sessions between the PE routers, and an interior gateway protocol (IGP) on the PE and P routers.

By default, Layer 3 VPNs are disabled.

Many of the configuration procedures for Layer 3 VPNs are common to all types of VPNs.