Configuring MPLS Layer 3 VPNs

This chapter describes how to configure Multiprotocol Label Switching (MPLS) Layer 3 virtual private networks (VPNs) on Cisco Nexus 3600 Series Switches.

Information About MPLS Layer 3 VPNs

An MPLS Layer 3 VPN consists of a set of sites that are interconnected by an MPLS provider core network. At each customer site, one or more customer edge (CE) routers or Layer 2 switches attach to one or more provider edge (PE) routers. This section includes the following topics:

MPLS Layer 3 VPN Definition
How an MPLS Layer 3 VPN Works
Components of MPLS Layer 3 VPNs
Hub-and-Spoke Topology
OSPF Sham-Link Support for MPLS VPN

MPLS Layer 3 VPN Definition

MPLS-based Layer 3 VPNs are based on a peer model that enables the provider and the customer to exchange Layer 3 routing information. The provider relays the data between the customer sites without direct customer involvement.

When you add a new site to an MPLS Layer 3 VPN, you must update the provider edge router that provides services to the customer site.

MPLS Layer 3 VPNs include the following components:

Provider (P) router—A router in the core of the provider network. P routers run MPLS switching and do not attach VPN labels (an MPLS label in each route assigned by the PE router) to routed packets. P routers forward packets based on the Label Distribution Protocol (LDP).
Provider edge (PE) router—A router that attaches the VPN label to incoming packets that are based on the interface or subinterface on which they are received. A PE router attaches directly to a CE router.
Customer edge (CE) router—An edge router on the network of the provider that connects to the PE router on the network. A CE router must interface with a PE router.

Figure 1. Basic MPLS Layer 3 VPN Terminology

How an MPLS Layer 3 VPN Works

MPLS Layer 3 VPN functionality is enabled at the edge of an MPLS network. The PE router performs the following tasks:

Exchanges routing updates with the CE router
Translates the CE routing information into VPN routes
Exchanges Layer 3 VPN routes with other PE routers through the Multiprotocol Border Gateway Protocol (MP-BGP)

Components of MPLS Layer 3 VPNs

An MPLS-based Layer 3 VPN network has three components:

VPN route target communities—A VPN route target community is a list of all members of a Layer 3 VPN community. You must configure the VPN route targets for each Layer 3 VPN community member.
Multiprotocol BGP peering of VPN community PE routers—Multiprotocol BGP propagates VRF reachability information to all members of a VPN community. You must configure Multiprotocol BGP peering in all PE routers within a VPN community.
MPLS forwarding—MPLS transports all traffic between all VPN community members across a VPN enterprise or service provider network.

A one-to-one relationship does not necessarily exist between customer sites and VPNs. A site can be a member of multiple VPNs. However, a site can associate with only one VRF. A customer-site VRF contains all the routes that are available to the site from the VPNs of which it is a member.

Hub-and-Spoke Topology

A hub-and-spoke topology prevents local connectivity between subscribers at the spoke provider edge (PE) routers and ensures that a hub site provides subscriber connectivity. Any sites that connect to the same PE router must forward intersite traffic using the hub site. This topology ensures that the routing at the spoke sites moves from the access-side interface to the network-side interface or from the network-side interface to the access-side interface but never from the access-side interface to the access-side interface. A hub-and-spoke topology allows you to maintain access restrictions between sites.

A hub-and-spoke topology prevents situations where the PE router locally switches the spokes without passing the traffic through the hub site. This topology prevents subscribers from directly connecting to each other. A hub-and-spoke topology does not require one VRF for each spoke.

As shown in the figure, a hub-and-spoke topology is typically set up with a hub PE that is configured with two VRFs:

VRF 2hub with a dedicated link connected to the hub customer edge (CE)
VRF 2spokes with another dedicated link connected to the hub CE.

Interior Gateway Protocol (IGP) or external BGP (eBGP) sessions are usually set up through the hub PE-CE links. The VRF 2hub imports all the exported route targets from all the spoke PEs. The hub CE learns all routes from the spoke sites and readvertises them back to the VRF 2spoke of the hub PE. The VRF 2spoke exports all these routes to the spoke PEs.

If you use eBGP between the hub PE and hub CE, you must allow duplicate autonomous system (AS) numbers in the path which is normally prohibited. You can configure the router to allow this duplicate AS number at the neighbor of VRF 2spokes of the hub PE and also for VPN address family neighbors at all the spoke PEs. In addition, you must disable the peer AS number check at the hub CE when distributing routes to the neighbor at VRF 2spokes of the hub PE.

OSPF Sham-Link Support for MPLS VPN

In a Multiprotocol Label Switching (MPLS) VPN configuration, you can use the Open Shortest Path First (OSPF) protocol to connect customer edge (CE) devices to service provider edge (PE) devices in the VPN backbone. Many customers run OSPF as their intrasite routing protocol, subscribe to a VPN service, and want to exchange routing information between their sites using OSPF (during migration or on a permanent basis) over an MPLS VPN backbone.

The benefits of the OSPF sham-link support for MPLS VPN are as follows:

Client site connection across the MPLS VPN Backbone—A sham link ensures that OSPF client sites that share a backdoor link can communicate over the MPLS VPN backbone and participate in VPN services.
Flexible routing in an MPLS VPN configuration—In an MPLS VPN configuration, the OSPF cost tha is configured with a sham link allows you to decide if OSPF client site traffic is routed over a backdoor link or through the VPN backbone.

The figure below shows an example of how VPN client sites that run OSPF can connect over an MPLS VPN backbone.

When you use OSPF to connect PE and CE devices, all routing information learned from a VPN site is placed in the VPN routing and forwarding (VRF) instance that is associated with the incoming interface. The PE devices that attach to the VPN use the Border Gateway Protocol (BGP) to distribute VPN routes to each other. A CE device can learn the routes to other sites in the VPN by peering with its attached PE device. The MPLS VPN super backbone provides an additional level of routing hierarchy to interconnect the VPN sites that are running OSPF.

When OSPF routes are propagated over the MPLS VPN backbone, additional information about the prefix in the form of BGP extended communities (route type, domain ID extended communities) is appended to the BGP update. This community information is used by the receiving PE device to decide the type of link-state advertisement (LSA) to be generated when the BGP route is redistributed to the OSPF PE-CE process. In this way, internal OSPF routes that belong to the same VPN and are advertised over the VPN backbone are seen as interarea routes on the remote sites.

Prerequisites for MPLS Layer 3 VPNs

MPLS Layer 3 VPNs has the following prerequisites:

Ensure that you have configured MPLS and Label Distribution Protocol (LDP) in your network. All routers in the core, including the PE routers, must be able to support MPLS forwarding.
Ensure that you have installed the correct license for MPLS and any other features you will be using with MPLS.

Guidelines and Limitations for MPLS Layer 3 VPNs

MPLS Layer 3 VPNs have the following configuration guidelines and limitations:

You can configure MPLS Layer 3 VPN (LDP) on Cisco Nexus 3600-R and Cisco Nexus 9504 and 9508 platform switches with the N9K-X9636C-RX, N9K-X9636C-R, N9K-X96136YC-R, and N9K-X9636Q-R line cards.
You must enable MPLS IP forwarding on interfaces where the forwarding decisions are made based on the labels of incoming packets. If a VPN label is allocated by per prefix mode, MPLS IP forwarding must be enabled on the link between PE and CE.
Packets with MPLS Explicit-NULL may not be parsed correctly with default line card profile.
MPLS Layer 3 VPNs support the following CE-PE routing protocols:
- BGP (IPv4 and IPv6)
- Enhanced Interior Gateway Protocol (EIGRP) (IPv4)
- Open Shortest Path First (OSPFv2)
- Routing Information Protocol (RIPv2)
Set statements in an import route map are ignored.
The BGP minimum route advertisement interval (MRAI) value for all iBGP and eBGP sessions is zero and is not configurable.
In a high scale setup with many BGP routes getting redistributed into EIGRP, modify the EIGRP signal timer to ensure that the EIGRP convergence time is higher than the BGP convergence time. This process allows all the BGP routes to be redistributed into EIGRP, before EIGRP signals convergence.
When OSPF is used as a protocol between PE and CE devices, the OSPF metric is preserved when routes are advertised over the VPN backbone. The metric is used on the remote PE devices to select the correct route. Do not modify the metric value when OSPF is redistributed to BGP and when BGP is redistributed to OSPF. If you modify the metric value, routing loops might occur.

Default Settings for MPLS Layer 3 VPNs

Table 1. Default MPLS Layer 3 VPN Parameters
Parameters	Default
L3VPN feature	Disabled
L3VPN SNMP notifications	Disabled
allowas-in (for a hub-and-spoke topology)	0
disable-peer-as-check (for a hub-and-spoke topology)	Disabled

Configuring MPLS Layer 3 VPNs

Configuring the Core Network

Assessing the Needs of MPLS Layer 3 VPN Customers

You can identify the core network topology so that it can best serve MPLS Layer 3 VPN customers.

Identify the size of the network:
- Identify the following to determine the number of routers and ports you need:
- How many customers do you need to support?
- How many VPNs are needed per customer?
- How many virtual routing and forwarding instances are there for each VPN?
Determine which routing protocols you need in the core network.

Determine if you need MPLS VPN high availability support.

Note

MPLS VPN nonstop forwarding and graceful restart are supported on select routers and Cisco NX-OS releases. You need to make sure that graceful restart for BGP and LDP is enabled.

Configure the routing protocols in the core network.
Determine if you need BGP load sharing and redundant paths in the MPLS Layer 3 VPN core.

Configuring MPLS in the Core

To enable MPLS on all routers in the core, you must configure a label distribution protocol. You can use either of the following as a label distribution protocol:

MPLS Label Distribution Protocol (LDP).

Configuring Multiprotocol BGP on the PE Routers and Route Reflectors

You can configure multiprotocol BGP connectivity on the PE routers and route reflectors.

Before you begin

Ensure that graceful restart is enabled on all routers for BGP and LDP.

SUMMARY STEPS

configure terminal
feature bgp
install feature-set mpls
feature-set mpls
feature-set mpls l3vpn
router bgp as - number
router-id ip-address
neighbor ip-addressremote-as as-number
address-family { vpnv4 | vpnv6 } unicast
send-community extended
show bgp { vpnv4 | vpnv6 } unicast neighbors
copy running-config startup-config

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `switch# configure terminal switch(config)#`	Enters global configuration mode.
Step 2	feature bgp Example: `switch(config)# feature bgp switch(config)#`	Enables the BGP feature.
Step 3	install feature-set mpls Example: `switch(config)# install feature-set mpls switch(config)#`	Installs the MPLS feature set.
Step 4	feature-set mpls Example: `switch(config)# feature-set mpls switch(config)#`	Enables the MPLS feature-set.
Step 5	feature-set mpls l3vpn Example: `switch(config)# feature-set mpls l3vpn switch(config)#`	Enables the MPLS Layer 3 VPN feature.
Step 6	router bgp `as - number` Example: `switch(config)# router bgp 1.1`	Configures a BGP routing process and enters router configuration mode. The as-number argument indicates the number of an autonomous system that identifies the router to other BGP routers and tags the routing information. The AS number can be a 16-bit integer or a 32-bit integer in the form of a higher 16-bit decimal number and a lower 16-bit decimal number in xx.xx format.
Step 7	router-id `ip-address` Example: `switch(config-router)# router-id 192.0.2.255`	(Optional) Configures the BGP router ID. This IP address identifies this BGP speaker. This command triggers an automatic notification and session reset for the BGP neighbor sessions. .
Step 8	neighbor `ip-address`remote-as `as-number` Example: `switch(config-router)# neighbor 209.165.201.1 remote-as 1.1 switch(config-router-neighbor)#`	Adds an entry to the iBGP neighbor table. The ip-address argument specifies the IP address of the neighbor in dotted decimal notation.
Step 9	address-family { vpnv4 \| vpnv6 } unicast Example: `switch(config-router-neighbor)# address-family vpnv4 unicast switch(config-router-neighbor-af)#`	Enters address family configuration mode for configuring routing sessions, such as BGP, that use standard VPNv4 or VPNv6 address prefixes.
Step 10	send-community extended Example: `switch(config-router-neighbor-af)# send-community extended`	Specifies that a communities attribute should be sent to a BGP neighbor.
Step 11	show bgp { vpnv4 \| vpnv6 } unicast neighbors Example: `switch(config-router-neighbor-af)# show bgp vpnv4 unicast neighbors`	(Optional) Displays information about BGP neighbors.
Step 12	copy running-config startup-config Example: `switch(config-router-vrf)# copy running-config startup-config`	(Optional) Copies the running configuration to the startup configuration.

Connecting the MPLS VPN Customers

Defining VRFs on the PE Routers to Enable Customer Connectivity

You must create VRFs on the PE routers to enable customer connectivity. You configure route targets to control which IP prefixes are imported into the customer VPN site and which IP prefixes are exported to the BGP network. You can optionally use an import or export route map to provide more fine-grained control over the IP prefixes that are imported into the customer VPN site or exported out of the VPN site. You can use a route map to filter routes that are eligible for import or export in a VRF, based on the route target extended community attributes of the route. The route map might, for example, deny access to selected routes from a community that is on the import route target list.

SUMMARY STEPS

configure terminal
install feature-set mpls
feature-set mpls
feature-set mpls l3vpn
vrf context vrf-name
rd route-distinguisher
address-family { ipv4 | ipv6 } unicast
route-target { import | export } route-target-ext-community }
maximum routes max-routes [ threshold value ] [ reinstall ]
import [ vrf default max-prefix ] map route-map
show vrf vrf-name
copy running-config startup-config

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `switch# configure terminal switch(config)#`	Enters global configuration mode.
Step 2	install feature-set mpls Example: `switch(config)# install feature-set mpls switch(config)#`	Installs the MPLS feature set.
Step 3	feature-set mpls Example: `switch(config)# feature-set mpls switch(config)#`	Enables the MPLS feature-set.
Step 4	feature-set mpls l3vpn Example: `switch(config)# feature-set mpls l3vpn switch(config)#`	Enables the MPLS Layer 3 VPN feature.
Step 5	vrf context `vrf-name` Example: `switch(config)# vrf context vpn1 switch(config-vrf)#`	Defines the VPN routing instance by assigning a VRF name and enters VRF configuration mode. The vrf-name argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 6	rd `route-distinguisher` Example: `switch(config-vrf)# rd 1.2:1 switch(config-vrf)#`	Configures the route distinguisher. The route-distinguisher argument adds an 8-byte value to an IPv4 prefix to create a VPN IPv4 prefix. You can enter an RD in either of these formats: 16-bit or 32-bit AS number: your 32-bit number, for example, 1.2:3 32-bit IP address: your 16-bit number, for example, 192.0.2.1:1
Step 7	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-vrf)# address-family ipv4 unicast switch(config-vrf-af-ipv4)#`	Specifies the IPv4 address family type and enters address family configuration mode.
Step 8	route-target { import \| export } `route-target-ext-community` } Example: `switch(config-vrf-af-ipv4)# route-target import 1.0:1`	Specifies a route-target extended community for a VRF as follows: The import keyword imports routing information from the target VPN extended community. The export keyword exports routing information to the target VPN extended community. The route-target-ext-community argument adds the route-target extended community attributes to the VRF's list of import or export route-target extended communities. You can enter the route-target-ext-community argument in either of these formats: 16-bit or 32-bit AS number: your 32-bit number, for example, 1.2:3 32-bit IP address: your 16-bit number, for example, 192.0.2.1:1
Step 9	maximum routes `max-routes` [ threshold `value` ] [ reinstall ] Example: `switch(config-vrf-af-ipv4)# maximum routes 10000`	(Optional) Configures the maximum number of routes that can be stored in the VRF route table. The max-routes range is from 1 to 4294967295. The threshold value range is from 1 to 100.
Step 10	import [ vrf default `max-prefix` ] map `route-map` Example: `switch(config-vrf-af-ipv4)# import vrf default map vpn1-route-map`	(Optional) Configures an import policy for a VRF to import prefixes from the default VRF as follows: The max-prefix range is from 1 to 2147483647. The default is 1000 prefixes. The route-map argument specifies the route map to be used as an import route map for the VRF and can be any case-sensitive, alphanumeric string up to 63 characters.
Step 11	show vrf `vrf-name` Example: `switch(config-vrf-af-ipv4)# show vrf vpn1`	(Optional) Displays information about a VRF. The vrf-name argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 12	copy running-config startup-config Example: `switch(config-router-vrf)# copy running-config startup-config`	(Optional) Copies the running configuration to the startup configuration.

Configuring VRF Interfaces on PE Routers for Each VPN Customer

You can associate a virtual routing and forwarding instance (VRF) with an interface or subinterface on the PE routers.

SUMMARY STEPS

configure terminal
interface type number
vrf member vrf-name
show vrf vrf-name interface
copy running-config startup-config

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `switch# configure terminal switch(config)#`	Enters global configuration mode.
Step 2	interface `type number` Example: `switch(config)# interface Ethernet 5/0 switch(config-if)#`	Specifies the interface to configure and enters interface configuration mode as follows: The type argument specifies the type of interface to be configured. The number argument specifies the port, connector, or interface card number.
Step 3	vrf member `vrf-name` Example: `switch(config-if)# vrf member vpn1`	Associates a VRF with the specified interface or subinterface. The vrf-name argument is the name assigned to a VRF.
Step 4	show vrf `vrf-name` interface Example: `switch(config-if)# show vrf vpn1 interface`	(Optional) Displays information about interfaces associated with a VRF. The vrf-name argument is any case-sensitive alphanumeric string up to 32 characters.
Step 5	copy running-config startup-config Example: `switch(config-router-vrf)# copy running-config startup-config`	(Optional) Copies the running configuration to the startup configuration.

Configuring Routing Protocols Between the PE and CE Routers

Configuring Static or Directly Connected Routes Between the PE and CE Routers

You can configure the PE router for PE-to-CE routing sessions that use static routes.

SUMMARY STEPS

configure terminal
vrf context vrf-name
{ ip ipv6 } route prefix nexthop
address-family { ipv4 | ipv6 } unicast
feature bgp as - number
router bgp as - number
vrf vrf-name
address-family { ipv4 | ipv6 } unicast
redistribute static route-map map-name
redistribute direct route-map map-name
show { ipv4 | ipv6 } route vrf vrf-name
copy running-config startup-config

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `switch# configure terminal switch(config)#`	Enters global configuration mode.
Step 2	vrf context `vrf-name` Example: `switch(config)# vrf context vpn1 switch(config-vrf)#`	Defines the VPN routing instance by assigning a VRF name and enters VRF configuration mode. The vrf-name argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 3	{ ip ipv6 } route `prefix nexthop` Example: `switch(config-vrf)# ip route 192.0.2.1/28 ethernet 2/1`	Defines static route parameters for every PE-to-CE session. The prefix and nexthop are as follows: IPv4—in dotted decimal notation IPv6—in hex format.
Step 4	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-vrf)# address-family ipv4 unicast switch(config-vrf-af)#`	Specifies the IPv4 address family type and enters address family configuration mode.
Step 5	feature bgp `as - number` Example: `switch(config-vrf-af)# feature bgp switch(config)#`	Enables the BGP feature.
Step 6	router bgp `as - number` Example: `switch(config)# router bgp 1.1`	Configures a BGP routing process and enters router configuration mode. The as-number argument indicates the number of an autonomous system that identifies the router to other BGP routers and tags the routing information. The AS number can be a 16-bit integer or a 32-bit integer in the form of a higher 16-bit decimal number and a lower 16-bit decimal number in xx.xx format.
Step 7	vrf `vrf-name` Example: `switch(config-router)# vrf vpn1 switch(config--router-vrf)#`	Associates the BGP process with a VRF. The vrf-name argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 8	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-vrf)# address-family ipv4 unicast switch(config-vrf-af)#`	Specifies the IPv4 address family type and enters address family configuration mode.
Step 9	redistribute static route-map `map-name` Example: `switch(config-router-vrf-af)# redistribute static route-map StaticMap`	Redistributes static routes into BGP. The map-name can be any case-sensitive, alphanumeric string up to 63 characters.
Step 10	redistribute direct route-map `map-name` Example: `switch(config-router-vrf-af)# redistribute direct route-map StaticMap`	Redistributes directly connected routes into BGP. The map-name can be any case-sensitive, alphanumeric string up to 63 characters.
Step 11	show { ipv4 \| ipv6 } route vrf `vrf-name` Example: `switch(config-router-vrf-af)# show ip ipv4 route vrf vpn1`	(Optional) Displays information about routes. The vrf-name argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 12	copy running-config startup-config Example: `switch(config-router-vrf)# copy running-config startup-config`	(Optional) Copies the running configuration to the startup configuration.

Configuring BGP as the Routing Protocol Between the PE and CE Routers

You can use eBGP to configure the PE router for PE-to-CE routing sessions.

SUMMARY STEPS

configure terminal
feature bgp
router bgp as - number
vrf vrf-name
neighbor ip-addressremote-as as-number
address-family { ipv4 | ipv6 } unicast
show bgp { vpnv4 | vpnv6 } unicast neighbors vrf vrf-name
copy running-config startup-config

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `switch# configure terminal switch(config)#`	Enters global configuration mode.
Step 2	feature bgp Example: `switch(config)# feature bgp switch(config)#`	Enables the BGP feature.
Step 3	router bgp `as - number` Example: `switch(config)# router bgp 1.1 switch(config-router)#`	Configures a BGP routing process and enters router configuration mode. The as-number argument indicates the number of an autonomous system that identifies the router to other BGP routers and tags the routing information passed along. The AS number can be a 16-bit integer or a 32-bit integer in the form of a higher 16-bit decimal number and a lower 16-bit decimal number in xx.xx format.
Step 4	vrf `vrf-name` Example: `switch(config-router)# vrf vpn1 switch(config--router-vrf)#`	Associates the BGP process with a VRF. The vrf-name argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 5	neighbor `ip-address`remote-as `as-number` Example: `switch(config-router)# neighbor 209.165.201.1 remote-as 1.1 switch(config-router-neighbor)#`	Adds an entry to the iBGP neighbor table. The ip-address argument specifies the IP address of the neighbor in dotted decimal notation. The as-number argument specifies the autonomous system to which the neighbor belongs.
Step 6	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-vrf)# address-family ipv4 unicast switch(config-vrf-af)#`	Enters address family configuration mode for configuring routing sessions, such as BGP, that use standard IPv4 or IPv6 address prefixes.
Step 7	show bgp { vpnv4 \| vpnv6 } unicast neighbors vrf `vrf-name` Example: `switch(config-router-neighbor-af)# show bgp vpnv4 unicast neighbors`	(Optional) Displays information about BGP neighbors. The vrf-name argument is any case-sensitive alphanumeric string up to 32 characters.
Step 8	copy running-config startup-config Example: `switch(config-router-vrf)# copy running-config startup-config`	(Optional) Copies the running configuration to the startup configuration.

Configuring RIPv2 Between the PE and CE Routers

You can use RIP to configure the PE router for PE-to-CE routing sessions.

SUMMARY STEPS

configure terminal
feature rip
router rip instance-tag
vrf vrf-name
address-family ipv4 unicast
redistribute { bgp as | direct | { egrip | ospf | rip } instance-tag | static } route-map map-name vrf-name
show ip rip vrf vrf-name
copy running-config startup-config

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `switch# configure terminal switch(config)#`	Enters global configuration mode.
Step 2	feature rip Example: `switch(config)# feature rip switch(config)#`	Enables the RIP feature.
Step 3	router rip `instance-tag` Example: `switch(config)# router rip Test1`	Enables RIP and enters router configuration mode. The instance-tag can be any case-sensitive, alphanumeric string up to 20 characters.
Step 4	vrf `vrf-name` Example: `switch(config-router)# vrf vpn1 switch(config--router-vrf)#`	Associates the RIP process with a VRF. The vrf-name argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 5	address-family ipv4 unicast Example: `switch(config-router-vrf)# address-family ipv4 unicast switch(config-router-vrf-af)#`	Specifies the address family type and enters address family configuration mode.
Step 6	redistribute { bgp as \| direct \| { egrip \| ospf \| rip } `instance-tag` \| static } route-map `map-name` `vrf-name` Example: `switch(config-router-vrf-af)# show ip rip vrf vpn1`	Redistributes routes from one routing domain into another routing domain. The as number can be a 16-bit integer or a 32-bit integer in the form of a higher 16-bit decimal number and a lower 16-bit decimal number in xx.xx format. The instance-tag can be any case-sensitive alphanumeric string up to 20 characters
Step 7	show ip rip vrf `vrf-name` Example: `switch(config-router-vrf-af)# show ip rip vrf vpn1`	(Optional) Displays information about RIP. The vrf-name argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 8	copy running-config startup-config Example: `switch(config-router-vrf)# copy running-config startup-config`	(Optional) Copies the running configuration to the startup configuration.

Configuring OSPF Between the PE and CE Routers

You can use OSPFv2 to configure the PE router for PE-to-CE routing sessions. You can optionally create an OSPF sham link if you have OSPF back door links that are not part of the MPLS network.

SUMMARY STEPS

configure terminal
feature ospf
router ospf instance-tag
vrf vrf-name
area area-id sham-link source-address destination-address
address-family { ipv4 | ipv6 } unicast
redistribute { bgp as | direct | { egrip | ospf | rip } instance-tag | static } route-map map-name
autonomous-system as-number
show ip egrip vrf vrf-name
copy running-config startup-config

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `switch# configure terminal switch(config)#`	Enters global configuration mode.
Step 2	feature ospf Example: `switch(config)# feature ospf switch(config)#`	Enables the OSPF feature.
Step 3	router ospf `instance-tag` Example: `switch(config)# router ospf Test1`	Enables OSPF and enters router configuration mode. The instance-tag can be any case-sensitive, alphanumeric string up to 20 characters.
Step 4	vrf `vrf-name` Example: `switch(config-router)# vrf vpn1 switch(config--router-vrf)#`	Enters router VRF configuration mode. The vrf-name argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 5	area area-id sham-link `source-address destination-address` Example: `switch(config-router-vrf)# area 1 sham-link 10.2.1.1 10.2.1.2`	(Optional) Configures the sham link on the PE interface within a specified OSPF area and with the loopback interfaces specified by the IP addresses as endpoints. You must configure the sham link at both PE endpoints.
Step 6
Step 7	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-router)# address-family ipv4 unicast switch(config-router-vrf-af)#`	Specifies the address family type and enters address family configuration mode.
Step 8	redistribute { bgp as \| direct \| { egrip \| ospf \| rip } `instance-tag` \| static } route-map `map-name` Example: `switch(config-router-vrf-af)# redistribute bgp 1.0 route-map BGPMap`	Redistributes BGP into the EIGRP. The autonomous system number of the BGP network is configured in this step. BGP must be redistributed into EIGRP for the CE site to accept the BGP routes that carry the EIGRP information. A metric must also be specified for the BGP network. The map-name can be any case-sensitive, alphanumeric string up to 63 characters.
Step 9	autonomous-system `as-number` Example: `switch(config-router-vrf-af)# autonomous-system 1.3`	(Optional) Specifies the autonomous system number for this address family for the customer site. The as-number argument indicates the number of an autonomous system that identifies the router to other BGP routers and tags the routing information passed along. The AS number can be a 16-bit integer or a 32-bit integer in the form of a higher 16-bit decimal number and a lower 16-bit decimal number in xx.xx format.
Step 10
Step 11	show ip egrip vrf `vrf-name` Example: `switch(config-router-vrf-af)# show ipv4 eigrp vrf vpn1`	(Optional) Displays information about EIGRP in this VRF. The vrf-name can be any case-sensitive, alphanumeric string up to 32 characters
Step 12	copy running-config startup-config Example: `switch(config-router-vrf)# copy running-config startup-config`	(Optional) Copies the running configuration to the startup configuration.

Configuring EIGRP Between the PE and CE Routers

You can configure the PE router to use Enhanced Interior Gateway Routing Protocol (EIGRP) between the PE and CE routers to transparently connect EIGRP customer networks through an MPLS-enabled BGP core network so that EIGRP routes are redistributed through the VPN across the BGP network as internal BGP (iBGP) routes.

Before you begin

You must configure BGP in the network core.

SUMMARY STEPS

configure terminal
feature egrip
router egrip instance-tag
vrf vrf-name
address-family ipv4 unicast
redistribute { bgp as-numberroute-map map-name
show ip ospf instance-tag vrf vrf-name
copy running-config startup-config

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `switch# configure terminal switch(config)#`	Enters global configuration mode.
Step 2	feature egrip Example: `switch(config)# feature egrip switch(config)#`	Enables the EGRIP feature.
Step 3	router egrip `instance-tag` Example: `switch(config)# router egrip Test1`	Configures an EIGRP instance and enters router configuration mode. The instance-tag can be any case-sensitive, alphanumeric string up to 20 characters.
Step 4	vrf `vrf-name` Example: `switch(config-router)# vrf vpn1 switch(config--router-vrf)#`	Enters router VRF configuration mode. The vrf-name argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 5	address-family ipv4 unicast Example: `switch(config-router-vrf)# address-family ipv4 unicast switch(config-router-vrf-af)#`	(Optional) Enters address family configuration mode for configuring routing sessions that use standard IPv4 address prefixes.
Step 6	redistribute { bgp as-numberroute-map `map-name` Example: `switch(config-router-vrf-af)# show ip rip vrf vpn1`	Redistributes routes from one routing domain into another routing domain. The as number can be a 16-bit integer or a 32-bit integer in the form of a higher 16-bit decimal number and a lower 16-bit decimal number in xx.xx format. The instance-tag can be any case-sensitive alphanumeric string up to 20 characters
Step 7	show ip ospf `instance-tag` vrf `vrf-name` Example: `switch(config-router-vrf-af)# show ip rip vrf vpn1`	(Optional) Displays information about OSPF.
Step 8	copy running-config startup-config Example: `switch(config-router-vrf)# copy running-config startup-config`	(Optional) Copies the running configuration to the startup configuration.

Configuring PE-CE Redistribution in BGP for the MPLS VPN

You must configure BGP to distribute the PE-CE routing protocol on every PE router that provides MPLS Layer 3 VPN services if the PE-CE protocol is not BGP.

SUMMARY STEPS

configure terminal
feature bgp
router bgp instance-tag
router id ip-address
router id ip-address remote-as as-number
update-source loopback [ 0 | 1 ]
address-family { ipv4 | ipv6 } unicast
send-community extended
vrf vrf-name
address-family { ipv4 | ipv6 } unicast
redistribute { direct | { egrip | ospfv3 | ospfv3 |rip } instance-tag | static } route-map map-name
show bgp { ipv4 | ipv6 } unicast vrf vrf-name
copy running-config startup-config

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `switch# configure terminal switch(config)#`	Enters global configuration mode.
Step 2	feature bgp Example: `switch(config)# feature bgp switch(config)#`	Enables the BGP feature.
Step 3	router bgp `instance-tag` Example: `switch(config)# router bgp 1.1 switch(config-router)#`	Configures a BGP routing process and enters router configuration mode. The as-number argument indicates the number of an autonomous system that identifies the router to other BGP routers and tags the routing information passed along. The AS number can be a 16-bit integer or a 32-bit integer in the form of a higher 16-bit decimal number and a lower 16-bit decimal number in xx.xx format.
Step 4	router id `ip-address` Example: `switch(config-router)# router-id 192.0.2.255 1 switch(config-router)#`	(Optional) Configures the BGP router ID. This IP address identifies this BGP speaker. This command triggers an automatic notification and session reset for the BGP neighbor sessions.
Step 5	router id `ip-address` remote-as `as-number` Example: `switch(config-router)# neighbor 209.165.201.1 remote-as 1.2 switch(config-router-neighbor)#`	Adds an entry to the BGP or multiprotocol BGP neighbor table.The ip-address argument specifies the IP address of the neighbor in dotted decimal notation.The as-number argument specifies the autonomous system to which the neighbor belongs.
Step 6	update-source loopback [ 0 \| 1 ] Example: `switch(config-router-neighbor)# update-source loopback 0#`	Specifies the source address of the BGP session.
Step 7	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-router-neighbor)# address-family vpnv4 switch(config-router-neighbor-af)#`	Enters address family configuration mode for configuring routing sessions, such as BGP, that use standard VPNv4 or VPNv6 address prefixes. The optional unicast keyword specifies VPNv4 or VPNv6 unicast address prefixes.
Step 8	send-community extended Example: `switch(config-router-neighbor-af)# send-community extended`	Specifies that a communities attribute should be sent to a BGP neighbor.
Step 9	vrf `vrf-name` Example: `switch(config-router-neighbor-af)# vrf vpn1 switch(config-router-vrf)#`	Enters router VRF configuration mode. The vrf-name argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 10	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-router-vrf)# address-family ipv4 unicast switch(config-router-vrf-af)#`	Enters address family configuration mode for configuring routing sessions that use standard IPv4 or IPv6 address prefixes.
Step 11	redistribute { direct \| { egrip \| ospfv3 \| ospfv3 \|rip } `instance-tag` \| static } route-map `map-name` Example: `switch(config-router-af-vrf)# redistribute eigrp Test2 route-map EigrpMap`	Redistributes routes from one routing domain into another routing domain. The as number can be a 16-bit integer or a 32-bit integer in the form of a higher 16-bit decimal number and a lower 16-bit decimal number in xx.xx format. The instance-tag can be any case-sensitive, alphanumeric string up to 20 characters. The map-name can be any case-sensitive alphanumeric string up to 63 characters.
Step 12	show bgp { ipv4 \| ipv6 } unicast vrf `vrf-name` Example: `switch(config-router--vrf-af)# show bgp ipv4 unicast vrf vpn1vpn1`	(Optional) Displays information about BGP. The vrf-name argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 13	copy running-config startup-config Example: `switch(config-router-vrf)# copy running-config startup-config`	(Optional) Copies the running configuration to the startup configuration.

Configuring a Hub-and-Spoke Topology

Configuring VRFs on the Hub PE Router

You can configure hub and spoke VRFs on the hub PE router.

SUMMARY STEPS

configure terminal
install feature-set mpls
feature-set mpls
feature-set mpls l3vpn
vrf context vrf-hub
rd route-distinguisher
address-family { ipv4 | ipv6 } unicast
route-target { import | export } route-target-ext-community }
vrf context vrf-spoke
address-family { ipv4 | ipv6 } unicast
route-target { import | export } route-target-ext-community }
show running-config vrf vrf-name
copy running-config startup-config

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `switch# configure terminal switch(config)#`	Enters global configuration mode.
Step 2	install feature-set mpls Example: `switch(config)# install feature-set mpls switch(config)#`	Installs the MPLS feature set.
Step 3	feature-set mpls Example: `switch(config)# feature-set mpls switch(config)#`	Enables the MPLS feature-set.
Step 4	feature-set mpls l3vpn Example: `switch(config)# feature-set mpls l3vpn switch(config)#`	Enables the MPLS Layer 3 VPN feature.
Step 5	vrf context `vrf-hub` Example: `switch(config)# vrf context 2hub switch(config-vrf)#`	Defines the VPN routing instance for the PE hub by assigning a VRF name and enters VRF configuration mode. The vrf-hub argument is any case-sensitive alphanumeric string up to 32 characters.
Step 6	rd `route-distinguisher` Example: `switch(config-vrf)# rd 1.2:1 switch(config-vrf)#`	Configures the route distinguisher. The route-distinguisher argument adds an 8-byte value to an IPv4 prefix to create a VPN IPv4 prefix. You can enter an RD in either of these formats: 16-bit or 32-bit AS number: your 32-bit number, for example, 1.2:3 32-bit IP address: your 16-bit number, for example, 192.0.2.1:1
Step 7	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-vrf)# address-family ipv4 unicast switch(config-vrf-af-ipv4)#`	Specifies the IPv4 address family type and enters address family configuration mode.
Step 8	route-target { import \| export } route-target-ext-community } Example: `switch(config-vrf-af-ipv4)# route-target import 1.0:1`	Specifies a route-target extended community for a VRF as follows: The import keyword imports routing information from the target VPN extended community. The export keyword exports routing information to the target VPN extended community. The route-target-ext-community argument adds the route-target extended community attributes to the VRF's list of import or export route-target extended communities. You can enter the route-target-ext-community argument in either of these formats: 16-bit or 32-bit AS number: your 32-bit number, for example, 1.2:3 32-bit IP address: your 16-bit number, for example, 192.0.2.1:1
Step 9	vrf context `vrf-spoke` Example: `switch(config-vrf-af-ipv4)# vrf context 2spokes switch(config-vrf)#`	Defines the VPN routing instance for the PE spoke by assigning a VRF name and enters VRF configuration mode. The vrf-spoke argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 10	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-vrf)# address-family ipv4 unicast switch(config-vrf-af-ipv4)#`	Specifies the IPv4 address family type and enters address family configuration mode.
Step 11	route-target { import \| export } `route-target-ext-community` } Example: `switch(config-vrf-af-ipv4)# route-target export 1:100`	Specifies a route-target extended community for a VRF as follows: Creates a route-target extended community for a VRF. The import keyword imports routing information from the target VPN extended community. The export keyword exports routing information to the target VPN extended community. The route-target-ext-community argument adds the route-target extended community attributes to the VRF's list of import or export route-target extended communities. You can enter the route-target-ext-community argument in either of these formats: 16-bit or 32-bit AS number: your 32-bit number, for example, 1.2:3 32-bit IP address: your 16-bit number, for example, 192.0.2.1:1
Step 12	show running-config vrf `vrf-name` Example: `switch(config-vrf-af-ipv4)# show running-config vrf 2spokes`	(Optional) Displays the running configuration for the VRF. The vrf-name argument is any case-sensitive, alphanumeric string up to 32 characters. .
Step 13	copy running-config startup-config Example: `switch(config-router-vrf)# copy running-config startup-config`	(Optional) Copies the running configuration to the startup configuration.

Configuring eBGP on the Hub PE Router

You can use eBGP to configure PE-to-CE hub routing sessions.

Note

If all CE sites are using the same BGP AS number, you must perform the following tasks:

Configure either the BGP as-override command at the PE (hub) or the allowas-in command at the receiving CE router.
To advertise BGP routes learned from one ASN back to the same ASN, configure the disable-peer-as-check command at the PE router to prevent loopback.

SUMMARY STEPS

configure terminal
feature-set mpls
feature mpls l3vpn
feature bgp
router bgp as - number
neighbor ip-addressremote-as as-number
address-family { ipv4 | ipv6 } unicast
send-community extended
vrf vrf-hub
neighbor ip-addressremote-as as-number
address-family { ipv4 | ipv6 } unicast
as-override
vrf vrf-spoke
neighbor ip-addressremote-as as-number
address-family { ipv4 | ipv6 } unicast
allowas-in [ number ]
show running-config bgp vrf-name
copy running-config startup-config

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `switch# configure terminal switch(config)#`	Enters global configuration mode.
Step 2	feature-set mpls Example: `switch(config)# feature-set mpls`	Enables the MPLS feature-set.
Step 3	feature mpls l3vpn Example: `switch(config)# feature mpls l3vpn`	Enables the MPLS Layer 3 VPN feature.
Step 4	feature bgp Example: `switch(config)# feature bgp switch(config)#`	Enables the BGP feature.
Step 5	router bgp `as - number` Example: `switch(config)# router bgp 1.1 switch(config-router)#`	Configures a BGP routing process and enters router configuration mode. The `as-number` argument indicates the number of an autonomous system that identifies the router to other BGP routers and tags the routing information passed along. The AS number can be a 16-bit integer or a 32-bit integer in the form of a higher 16-bit decimal number and a lower 16-bit decimal number in xx.xx format.
Step 6	neighbor `ip-address`remote-as `as-number` Example: `switch(config-router)# neighbor 209.165.201.1 remote-as 1.2 switch(config-router-neighbor)#`	Adds an entry to the iBGP neighbor table. The ip-address argument specifies the IP address of the neighbor in dotted decimal notation. The as-number argument specifies the autonomous system to which the neighbor belongs.
Step 7	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-router-vrf-neighbor)# address-family ipv4 unicast switch(config-router-neighbor-af)#`	Specifies the IP address family type and enters address family configuration mode.
Step 8	send-community extended Example: `switch(config-router-neighbor-af)# send-community extended`	(Optional) Configures BGP to advertise extended community lists.
Step 9	vrf `vrf-hub` Example: `switch(config-router-neighbor-af)# vrf 2hub switch(config-router-vrf)#`	Enters VRF configuration mode. The `vrf-hub` argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 10	neighbor `ip-address`remote-as `as-number` Example: `switch(config-router-vrf)# neighbor 33.0.0.33 1 remote-as 150 switch(config-router-vrf-neighbor)#`	Adds an entry to the BGP or multiprotocol BGP neighbor table for this VRF. The ip-address argument specifies the IP address of the neighbor in dotted decimal notation. The as-number argument specifies the autonomous system to which the neighbor belongs.
Step 11	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-router-vrf-neighbor)# address-family ipv4 unicast switch(config-router--vrf-neighbor-af)#`	Specifies the IP address family type and enters address family configuration mode.
Step 12	as-override Example: `switch(config-router-vrf-neighbor-af)# as-override`	(Optional) Overrides the AS-number when sending an update. If all BGP sites are using the same AS number, of the following commands: Configure the BGP as-override command at the PE (hub) or Configure the allowas-in command at the receiving CE router.
Step 13	vrf `vrf-spoke` Example: `switch(config-router-vrf-neighbor-af)# vrf 2spokes switch(config-router-vrf)#`	Enters VRF configuration mode. The vrf-spoke argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 14	neighbor `ip-address`remote-as `as-number` Example: `switch(config-router-vrf)# neighbor 33.0.0.33 1 remote-as 150 switch(config-router-vrf-neighbor)#`	Adds an entry to the BGP or multiprotocol BGP neighbor table for this VRF. The ip-address argument specifies the IP address of the neighbor in dotted decimal notation. The as-number argument specifies the autonomous system to which the neighbor belongs.
Step 15	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-router-vrf-neighbor)# address-family ipv4 unicast switch(config-router--vrf-neighbor-af)#`	Specifies the IP address family type and enters address family configuration mode.
Step 16	allowas-in [ `number` ] Example: `switch(config-router-vrf-neighbor-af)# allowas-in 3`	(Optional) Allows duplicate AS numbers in the AS path. Configure this parameter in the VPN address family configuration mode at the PE spokes and at the neighbor mode at the PE hub.
Step 17	show running-config bgp `vrf-name` Example: `switch(config-router-vrf-neighbor-af)# show running-config bgp`	(Optional) Displays the running configuration for BGP.
Step 18	copy running-config startup-config Example: `switch(config-router-vrf)# copy running-config startup-config`	(Optional) Copies the running configuration to the startup configuration.

Configuring eBGP on the Hub CE Router

You can use eBGP to configure PE-to-CE hub routing sessions.

Note

Note If all CE sites are using the same BGP AS number, you must perform the following tasks:

Configure either the as-override command at the PE (hub) or the allowas-in command at the receiving CE router.
Configure the disable-peer-as-check command at the CE router.
To advertise BGP routes learned from one ASN back to the same ASN, configure the disable-peer-as-check command at the PE router to prevent loopback.

SUMMARY STEPS

configure terminal
feature-set mpls
feature mpls l3vpn
feature bgp
router bgp as - number
neighbor ip-addressremote-as as-number
address-family { ipv4 | ipv6 } unicast
send-community extended
vrf vrf-hub
neighbor ip-addressremote-as as-number
address-family { ipv4 | ipv6 } unicast
as-override
vrf vrf-spoke
neighbor ip-addressremote-as as-number
address-family { ipv4 | ipv6 } unicast
allowas-in [ number ]
show running-config bgp vrf-name
copy running-config startup-config

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `switch# configure terminal switch(config)#`	Enters global configuration mode.
Step 2	feature-set mpls Example: `switch(config)# feature-set mpls`	Enables the MPLS feature-set.
Step 3	feature mpls l3vpn Example: `switch(config)# feature mpls l3vpn`	Enables the MPLS Layer 3 VPN feature.
Step 4	feature bgp Example: `switch(config)# feature bgp switch(config)#`	Enables the BGP feature.
Step 5	router bgp `as - number` Example: `switch(config)# router bgp 1.1 switch(config-router)#`	Configures a BGP routing process and enters router configuration mode. The `as-number` argument indicates the number of an autonomous system that identifies the router to other BGP routers and tags the routing information passed along. The AS number can be a 16-bit integer or a 32-bit integer in the form of a higher 16-bit decimal number and a lower 16-bit decimal number in xx.xx format.
Step 6	neighbor `ip-address`remote-as `as-number` Example: `switch(config-router)# neighbor 209.165.201.1 remote-as 1.2 switch(config-router-neighbor)#`	Adds an entry to the iBGP neighbor table. The ip-address argument specifies the IP address of the neighbor in dotted decimal notation. The as-number argument specifies the autonomous system to which the neighbor belongs.
Step 7	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-router-vrf-neighbor)# address-family ipv4 unicast switch(config-router-neighbor-af)#`	Specifies the IP address family type and enters address family configuration mode.
Step 8	send-community extended Example: `switch(config-router-neighbor-af)# send-community extended`	(Optional) Configures BGP to advertise extended community lists.
Step 9	vrf `vrf-hub` Example: `switch(config-router-neighbor-af)# vrf 2hub switch(config-router-vrf)#`	Enters VRF configuration mode. The `vrf-hub` argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 10	neighbor `ip-address`remote-as `as-number` Example: `switch(config-router-vrf)# neighbor 33.0.0.33 1 remote-as 150 switch(config-router-vrf-neighbor)#`	Adds an entry to the BGP or multiprotocol BGP neighbor table for this VRF. The ip-address argument specifies the IP address of the neighbor in dotted decimal notation. The as-number argument specifies the autonomous system to which the neighbor belongs.
Step 11	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-router-vrf-neighbor)# address-family ipv4 unicast switch(config-router--vrf-neighbor-af)#`	Specifies the IP address family type and enters address family configuration mode.
Step 12	as-override Example: `switch(config-router-vrf-neighbor-af)# as-override`	(Optional) Overrides the AS-number when sending an update. If all BGP sites are using the same AS number, of the following commands: Configure the BGP as-override command at the PE (hub) or Configure the allowas-in command at the receiving CE router.
Step 13	vrf `vrf-spoke` Example: `switch(config-router-vrf-neighbor-af)# vrf 2spokes switch(config-router-vrf)#`	Enters VRF configuration mode. The vrf-spoke argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 14	neighbor `ip-address`remote-as `as-number` Example: `switch(config-router-vrf)# neighbor 33.0.0.33 1 remote-as 150 switch(config-router-vrf-neighbor)#`	Adds an entry to the BGP or multiprotocol BGP neighbor table for this VRF. The ip-address argument specifies the IP address of the neighbor in dotted decimal notation. The as-number argument specifies the autonomous system to which the neighbor belongs.
Step 15	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-router-vrf-neighbor)# address-family ipv4 unicast switch(config-router--vrf-neighbor-af)#`	Specifies the IP address family type and enters address family configuration mode.
Step 16	allowas-in [ `number` ] Example: `switch(config-router-vrf-neighbor-af)# allowas-in 3`	(Optional) Allows duplicate AS numbers in the AS path. Configure this parameter in the VPN address family configuration mode at the PE spokes and at the neighbor mode at the PE hub.
Step 17	show running-config bgp `vrf-name` Example: `switch(config-router-vrf-neighbor-af)# show running-config bgp`	(Optional) Displays the running configuration for BGP.
Step 18	copy running-config startup-config Example: `switch(config-router-vrf)# copy running-config startup-config`	(Optional) Copies the running configuration to the startup configuration.

Configuring VRFs on the Spoke PE Router

You can configure hub and spoke VRFs on the spoke PE router.

SUMMARY STEPS

configure terminal
install feature-set mpls
feature-set mpls
feature-set mpls l3vpn
vrf context vrf-spoke
rd route-distinguisher
address-family { ipv4 | ipv6 } unicast
route-target { import | export } route-target-ext-community }
show running-config vrf vrf-name
copy running-config startup-config

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `switch# configure terminal switch(config)#`	Enters global configuration mode.
Step 2	install feature-set mpls Example: `switch(config)# install feature-set mpls switch(config)#`	Installs the MPLS feature set.
Step 3	feature-set mpls Example: `switch(config)# feature-set mpls switch(config)#`	Enables the MPLS feature-set.
Step 4	feature-set mpls l3vpn Example: `switch(config)# feature-set mpls l3vpn switch(config)#`	Enables the MPLS Layer 3 VPN feature.
Step 5	vrf context `vrf-spoke` Example: `switch(config)# vrf context spoke switch(config-vrf)#`	Defines the VPN routing instance for the PE spoke by assigning a VRF name and enters VRF configuration mode. The vrf-spoke argument is any case-sensitive, alphanumeric string up to 32 characters.
Step 6	rd `route-distinguisher` Example: `switch(config-vrf)# rd 1.101 switch(config-vrf)#`	Configures the route distinguisher. The route-distinguisher argument adds an 8-byte value to an IPv4 prefix to create a VPN IPv4 prefix. You can enter an RD in either of these formats: 16-bit or 32-bit AS number: your 32-bit number, for example, 1.2:3 32-bit IP address: your 16-bit number, for example, 192.0.2.1:1
Step 7	address-family { ipv4 \| ipv6 } unicast Example: `switch(config-vrf)# address-family ipv4 unicast switch(config-vrf-af-ipv4)#`	Specifies the IPv4 address family type and enters address family configuration mode.
Step 8	route-target { import \| export } route-target-ext-community } Example: `switch(config-vrf-af-ipv4)# route-target import 1.0:1`	Specifies a route-target extended community for a VRF as follows: The import keyword imports routing information from the target VPN extended community. The export keyword exports routing information to the target VPN extended community. The route-target-ext-community argument adds the route-target extended community attributes to the VRF's list of import or export route-target extended communities. You can enter the route-target-ext-community argument in either of these formats: 16-bit or 32-bit AS number: your 32-bit number, for example, 1.2:3 32-bit IP address: your 16-bit number, for example, 192.0.2.1:1
Step 9	show running-config vrf `vrf-name` Example: `switch(config-vrf-af-ipv4)# show running-config vrf 2spokes`	(Optional) Displays the running configuration for the VRF. The vrf-name argument is any case-sensitive, alphanumeric string up to 32 characters. .
Step 10	copy running-config startup-config Example: `switch(config-router-vrf)# copy running-config startup-config`	(Optional) Copies the running configuration to the startup configuration.

Configuring eBGP on the Spoke PE Router

You can use eBGP to configure PE spoke routing sessions.

Note

If all CE sites are using the same BGP AS number, you must perform the following tasks:

Configure the the allowas-in command at the receiving spoke router.

SUMMARY STEPS

configure terminal
feature-set mpls
feature mpls l3vpn
feature bgp
router bgp as - number
neighbor ip-addressremote-as as-number
address-family { ipv4 | ipv6 } unicast
allowas-in number
send-community extended
show running-config bgp
copy running-config startup-config

DETAILED STEPS

Command or Action Purpose

Step 1

configure terminal

Example:

switch# configure terminal
switch(config)#

Enters global configuration mode.

Step 2

feature-set mpls

Example:

switch(config)# feature-set mpls

Enables the MPLS feature-set.

Step 3

feature mpls l3vpn

Example:

switch(config)# feature mpls l3vpn

Enables the MPLS Layer 3 VPN feature.

Step 4

feature bgp

Example:

switch(config)# feature bgp

switch(config)#

Enables the BGP feature.

Step 5

router bgp as - number

Example:

switch(config)# router bgp 100

switch(config-router)#

Configures a BGP routing process and enters router configuration mode.

The as-number argument indicates the number of an autonomous system that identifies the router to other BGP routers and tags the routing information passed along. The AS number can be a 16-bit integer or a 32-bit integer in the form of a higher 16-bit decimal number and a lower 16-bit decimal number in xx.xx format.

Step 6

neighbor ip-addressremote-as as-number

Example:

switch(config-router)# neighbor 63.63.0.63 remote-as 100

switch(config-router-neighbor)#

Adds an entry to the iBGP neighbor table.

The ip-address argument specifies the IP address of the neighbor in dotted decimal notation.
The as-number argument specifies the autonomous system to which the neighbor belongs.

Step 7

address-family { ipv4 | ipv6 } unicast

Example:

switch(config-router-vrf-neighbor)# address-family ipv4 unicast

switch(config-router-neighbor-af)#

Specifies the IPv4 or IPv6 address family type and enters address family configuration mode.

Step 8

allowas-in number

Example:

switch(config-router-vrf-neighbor-af)# allowas-in 3

(Optional) Allows an AS path with the PE ASN for a specified number of times.

The range is from 1 to 10
If all BGP sites are using the same AS number, of the following commands:

Note

Configure the BGP as-override command at the PE (hub) or Configure the allowas-in command at the receiving CE router.

Step 9

send-community extended

Example:

switch(config-router-neighbor)# send-community extended

(Optional) Configures BGP to advertise extended community lists.

Step 10

show running-config bgp

Example:

switch(config-router-vrf-neighbor-af)# show running-config bgp

(Optional) Displays the running configuration for BGP.

Step 11

copy running-config startup-config

Example:

switch(config-router-vrf)# copy running-config startup-config

(Optional) Copies the running configuration to the startup configuration.

Configuring MPLS using Hardware Profile Command

Beginning with release 7.0(3)F3(3), Cisco Nexus 3600 supports multiple hardware profiles. You can configure MPLS and/or VXLAN using hardware profile configuration command in a switch. The hardware profile configuration command invokes appropriate configuration files that are available on the switch. VXLAN is enabled by default

Before you begin

SUMMARY STEPS

configure terminal
feature bgp
hardware profile [ vxlan | mpls] module all
show hardware profile module [ all | number]
show module internal sw info | [ i | mpls]
show running configuration | [ i | mpls]

DETAILED STEPS

	Command or Action	Purpose
Step 1	configure terminal Example: `switch# configure terminal switch(config)#`	Enters global configuration mode.
Step 2	feature bgp Example: `switch(config)# feature bgp switch(config)#`	Enables the BGP feature.
Step 3	hardware profile [ vxlan \| mpls] module all Example: `switch(config)# hardware profile mpls module all`	Enables MPLS on all the switch modules. .
Step 4	show hardware profile module [ all \| `number`] Example: `switch(config)# show hardware profile module all switch(config)#`	Displays the hardware profile of all the modules or specific module.
Step 5	show module internal sw info \| [ i \| mpls] Example: `switch(config)# show module internal sw info`	Displays the switch software information.
Step 6	show running configuration \| [ i \| mpls] Example: `switch(config)# show module internal sw info`	Displays the running configuration.

Cisco Nexus 3600 Switch NX-OS Label Switching Configuration Guide, Release 10.4(x)

Bias-Free Language

Results

Chapter: Configuring MPLS Layer 3 VPNs

Configuring MPLS Layer 3 VPNs

Information About MPLS Layer 3 VPNs

MPLS Layer 3 VPN Definition

How an MPLS Layer 3 VPN Works

Components of MPLS Layer 3 VPNs

Hub-and-Spoke Topology

OSPF Sham-Link Support for MPLS VPN

Prerequisites for MPLS Layer 3 VPNs

Guidelines and Limitations for MPLS Layer 3 VPNs

Default Settings for MPLS Layer 3 VPNs

Configuring MPLS Layer 3 VPNs

Configuring the Core Network

Assessing the Needs of MPLS Layer 3 VPN Customers

Configuring MPLS in the Core

Configuring Multiprotocol BGP on the PE Routers and Route Reflectors

Before you begin

SUMMARY STEPS

DETAILED STEPS

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Connecting the MPLS VPN Customers

Defining VRFs on the PE Routers to Enable Customer Connectivity

SUMMARY STEPS

DETAILED STEPS

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Configuring VRF Interfaces on PE Routers for Each VPN Customer

SUMMARY STEPS

DETAILED STEPS

Example:

Example:

Example:

Example:

Example:

Configuring Routing Protocols Between the PE and CE Routers

Configuring Static or Directly Connected Routes Between the PE and CE Routers

SUMMARY STEPS

DETAILED STEPS

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Configuring BGP as the Routing Protocol Between the PE and CE Routers

SUMMARY STEPS

DETAILED STEPS

Example:

Example:

Example: