April 2015

Configuring Load Balancing Among EBGP and IBGP Routes When CEs Are Dual-Homed

When a CE is dual homed to two PEs, if one PE is in the same AS as the remote PE, whereas the other PE is not in the same AS as the remote PE, you can configure EBGP and IBGP route load balancing.

Networking Requirements

As shown in Figure 1, CE1 and CE2 belong to the same VPN instance. CE1 accesses the network respectively through PE3 in AS 100 and PE2 in AS 200. That is, CE1 is dual-homed to PE3 and PE2. CE2 accesses the network through PE1 in AS 100.

The Inter-AS BGP/MPLS IP VPN is implemented using Option C so that load balancing can be implemented among EBGP and IBGP routes.

Figure 1 Networking diagram of configuring load balancing among EBGP and IBGP routes when CEs are dual-homed

Configuration Roadmap

The configuration roadmap is as follows:

Establish the MP-EBGP peer relationship between the PEs in different ASs. Since the PEs are generally not directly connected, you also need to configure the maximum hops between the PEs for them to set up an EBGP connection.
Configure a routing policy on the ASBR: Allocate MPLS labels to the the routes received by the PE in the local AS before advertising the route to the remote ASBR; allocate new MPLS labels to the labeled IPv4 routes advertised to the PE in the local AS.
Configure the PEs to exchange the labeled IPv4 routes with the ASBRs in the local AS.
Enable the capability of exchanging the labeled IPv4 routes between the local ASBR and the remote ASBR.
In the BGP-VPN instance view of PE1, enable load balancing among EBGP and IBGP routes to CE1.

Data Preparation

To complete the configuration, you need the following data.

MPLS LSR IDs of PEs and ASBRs
Names of VPN instance created on PEs, RD, and VPN target
Routing policies configured on ASBRs
Maximum number of EBGP and IBGP routes that perform load balancing

Procedure

Configure IGP on the MPLS backbone networks in AS 100 and AS 200 to implement interconnection between PEs and ASBRs in each MPLS backbone network.

Take OSPF as an example. The detailed configuration procedure is not mentioned here.

NOTE:

Advertise the IP address of the loopback interface used as the LSR-ID through OSPF.

After the configuration, the OSPF neighbor relationship can be established between the ASBRs and the PEs in the same AS. Running the display ospf peer command, you can find that the neighbor status is Full.

Take the display on PE2 as an example.
```
<PE2> display ospf peer

          OSPF Process 1 with Router ID 4.4.4.9
                  Neighbors

 Area 0.0.0.0 interface 162.1.1.1(Pos1/0/0)'s neighbors
 Router ID: 3.3.3.9          Address: 162.1.1.2
   State: Full  Mode:Nbr is  Master  Priority: 1
   DR: None   BDR: None   MTU: 0
   Dead timer due in 31  sec
   Neighbor is up for 00:28:11
   Authentication Sequence: [ 0 ]
```
The ASBRs and the PEs in the same AS can learn the IP address of loopback1 from each other and ping through each other.
Configure basic MPLS functions and MPLS LDP on the MPLS backbone networks of AS 100 and AS 200 to establish LDP LSPs.
Configure the IBGP peer relationship of between AS 100 and AS 200 in the the IPv4 address family view.

For detailed configurations, see the following configuration files.
Configure the VPN instance on the PEs and configure the CEs to access the VPN instances.

NOTE:

VPN-Target attributes of the VPN instances of the PEs in different ASs must match each other.

For detailed configurations, see the following configuration files.
Enable the capability of exchanging labeled IPv4 routes.

Establish the MP-EBGP peer relationship between PE1 and PE2.

# Configure PE1.

[PE1] bgp 100

[PE1-bgp] peer 4.4.4.9 as-number 200

[PE1-bgp] peer 4.4.4.9 connect-interface LoopBack 1

[PE1-bgp] peer 4.4.4.9 ebgp-max-hop 10

[PE1-bgp] ipv4-family vpnv4

[PE1-bgp-af-vpnv4] peer 4.4.4.9 enable

[PE1-bgp-af-vpnv4] quit

[PE1-bgp] quit

# Configure PE2.

[PE2] bgp 200

[PE2-bgp] peer 1.1.1.9 as-number 100

[PE2-bgp] peer 1.1.1.9 connect-interface LoopBack 1

[PE2-bgp] peer 1.1.1.9 ebgp-max-hop 10

[PE2-bgp] ipv4-family vpnv4

[PE2-bgp-af-vpnv4] peer 1.1.1.9 enable

[PE2-bgp-af-vpnv4] quit

[PE2-bgp] quit

Configure load balancing among EBGP and IBGP routes on PE1.

# Configure PE1.

[PE1] bgp 100

[PE1-bgp] ipv4-family vpn-instance vpn3

[PE1-bgp-vpn3] load-balancing as-path-ignore

[PE1-bgp-vpn3] maximum load-balancing eibgp 2

[PE1-bgp-vpn3] quit

[PE1-bgp] quit

Verify the configuration.

After the preceding configurations, you can view that load balancing is performed among EBGP and IBGP routes on PE1.

<PE1> display ip routing-table vpn-instance vpn3

Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: vpn3
         Destinations : 4        Routes : 6

Destination/Mask    Proto  Pre  Cost        Flags NextHop         Interface

       10.1.1.0/24  BGP    255  0            RD  5.5.5.9         Pos2/0/0
                    BGP    255  0            RD  4.4.4.9         Pos1/0/0
       10.2.1.0/24  BGP    255  0            RD  4.4.4.9         Pos1/0/0
                    BGP    255  0            RD  5.5.5.9         Pos2/0/0
       10.3.1.0/24  Direct 0    0             D  10.3.1.1        GigabitEthernet3/0/0
       10.3.1.1/32  Direct 0    0             D  127.0.0.1       InLoopBack0

Configuration Files

Configuration file of PE1

#
 sysname PE1
#
ip vpn-instance vpn3
 ipv4-family
  route-distinguisher 300:1
  vpn-target 1:1 export-extcommunity
  vpn-target 1:1 import-extcommunity
#
 mpls lsr-id 1.1.1.9
 mpls
#
mpls ldp
#
interface Pos1/0/0
 link-protocol ppp
 undo shutdown
 ip address 172.1.1.2 255.255.255.0
 mpls
 mpls ldp
#
interface GigabitEthernet3/0/0
 undo shutdown
 ip binding vpn-instance vpn3
 ip address 10.3.1.1 255.255.255.0
#
interface Pos2/0/0
 link-protocol ppp
 undo shutdown
 ip address 192.2.1.1 255.255.255.0
 mpls
 mpls ldp
#
interface LoopBack1
 ip address 1.1.1.9 255.255.255.255
#
bgp 100
 peer 2.2.2.9 as-number 100
 peer 2.2.2.9 connect-interface LoopBack1
 peer 4.4.4.9 as-number 200
 peer 4.4.4.9 ebgp-max-hop 10
 peer 4.4.4.9 connect-interface LoopBack1
 peer 5.5.5.9 as-number 100
 peer 5.5.5.9 connect-interface LoopBack1
 #
 ipv4-family unicast
  undo synchronization
  import-route direct
  peer 2.2.2.9 enable
  peer 2.2.2.9 label-route-capability
  peer 4.4.4.9 enable
  peer 5.5.5.9 enable
 #
 ipv4-family vpnv4
  policy vpn-target
  peer 4.4.4.9 enable
  peer 5.5.5.9 enable
 #
 ipv4-family vpn-instance vpn3
  import-route direct
  maximum load-balancing eibgp 2
  load-balancing as-path-ignore
  peer 10.3.1.2 as-number 65002
#
ospf 1
 area 0.0.0.0
  network 1.1.1.9 0.0.0.0
  network 172.1.1.0 0.0.0.255
  network 192.2.1.0 0.0.0.255
#
return

Configuration file of ASBR1

#
 sysname ASBR1
#
 mpls lsr-id 2.2.2.9
 mpls
#
mpls ldp
#
interface Pos1/0/0
 link-protocol ppp
 undo shutdown
 ip address 172.1.1.1 255.255.255.0
 mpls
 mpls ldp
#
interface Pos2/0/0
 link-protocol ppp
 undo shutdown
 ip address 192.1.1.1 255.255.255.0
 mpls
#
interface LoopBack1
 ip address 2.2.2.9 255.255.255.255
#
bgp 100
 peer 1.1.1.9 as-number 100
 peer 1.1.1.9 connect-interface LoopBack1
 peer 192.1.1.2 as-number 200
 #
 ipv4-family unicast
  undo synchronization
  network 1.1.1.9 255.255.255.255
  network 172.1.1.0 255.255.255.0
  import-route direct
  peer 1.1.1.9 enable
  peer 1.1.1.9 route-policy policy2 export
  peer 1.1.1.9 label-route-capability
  peer 192.1.1.2 enable
  peer 192.1.1.2 route-policy policy1 export
  peer 192.1.1.2 label-route-capability
#
ospf 1
 area 0.0.0.0
  network 2.2.2.9 0.0.0.0
  network 172.1.1.0 0.0.0.255
#
route-policy policy1 permit node 1
 apply mpls-label
#
route-policy policy2 permit node 1
 if-match mpls-label
 apply mpls-label
#
return

Configuration file of ASBR2

#
 sysname ASBR2
#
 mpls lsr-id 3.3.3.9
 mpls
#
mpls ldp
#
interface Pos1/0/0
 link-protocol ppp
 undo shutdown
 ip address 162.1.1.1 255.255.255.0
 mpls
 mpls ldp
#
interface Pos2/0/0
 link-protocol ppp
 undo shutdown
 ip address 192.1.1.2 255.255.255.0
 mpls
#
interface LoopBack1
 ip address 3.3.3.9 255.255.255.255
#
bgp 200
 peer 4.4.4.9 as-number 200
 peer 4.4.4.9 connect-interface LoopBack1
 peer 192.1.1.1 as-number 100
 #
 ipv4-family unicast
  undo synchronization
  network 4.4.4.9 255.255.255.255
  network 162.1.1.0 255.255.255.0
  import-route direct
  peer 4.4.4.9 enable
  peer 4.4.4.9 route-policy policy4 export
  peer 4.4.4.9 label-route-capability
  peer 192.1.1.1 enable
  peer 192.1.1.1 route-policy policy3 export
  peer 192.1.1.1 label-route-capability
#
ospf 1
 area 0.0.0.0
  network 3.3.3.9 0.0.0.0
  network 162.1.1.0 0.0.0.255
#
route-policy policy3 permit node 1
 apply mpls-label
#
route-policy policy4 permit node 1
 if-match mpls-label
 apply mpls-label
#
return

Configuration file of PE2

#
 sysname PE2
#
ip vpn-instance vpn3
 ipv4-family
  route-distinguisher 300:1
  vpn-target 1:1 export-extcommunity
  vpn-target 1:1 import-extcommunity
#
 mpls lsr-id 4.4.4.9
 mpls
#
mpls ldp
#
interface Pos1/0/0
 link-protocol ppp
 undo shutdown
 ip address 162.1.1.2 255.255.255.0
 mpls
 mpls ldp
#
interface GigabitEthernet2/0/0
 undo shutdown
 ip binding vpn-instance vpn3
 ip address 10.2.1.1 255.255.255.0
#
interface LoopBack1
 ip address 4.4.4.9 255.255.255.255
#
bgp 200
 peer 1.1.1.9 as-number 100
 peer 1.1.1.9 ebgp-max-hop 10
 peer 1.1.1.9 connect-interface LoopBack1
 peer 3.3.3.9 as-number 200
 peer 3.3.3.9 connect-interface LoopBack1
 #
 ipv4-family unicast
  undo synchronization
  peer 1.1.1.9 enable
  peer 3.3.3.9 enable
  peer 3.3.3.9 label-route-capability
 #
 ipv4-family vpnv4
  policy vpn-target
  peer 1.1.1.9 enable
 #
 ipv4-family vpn-instance vpn3
  import-route direct
  peer 10.2.1.2 as-number 65001
#
ospf 1
 area 0.0.0.0
  network 4.4.4.9 0.0.0.0
  network 162.1.1.0 0.0.0.255
#      
return

Configuration file of PE3

#
 sysname PE3
#
ip vpn-instance vpn3
 ipv4-family
  route-distinguisher 300:1
  vpn-target 1:1 export-extcommunity
  vpn-target 1:1 import-extcommunity
#
 mpls lsr-id 5.5.5.9
 mpls
#
mpls ldp
#
interface Pos2/0/0
 link-protocol ppp
 undo shutdown
 ip address 192.2.1.2 255.255.255.0
 mpls
 mpls ldp
#
interface GigabitEthernet1/0/0
 undo shutdown
 ip binding vpn-instance vpn3
 ip address 10.1.1.1 255.255.255.0
#
interface LoopBack1
 ip address 5.5.5.9 255.255.255.255
#
bgp 100
 peer 1.1.1.9 as-number 100
 peer 1.1.1.9 connect-interface LoopBack1
 peer 10.1.1.2 as-number 65001
 #
 ipv4-family unicast
  undo synchronization
  import-route direct
  peer 1.1.1.9 enable
#
 ipv4-family vpnv4
  policy vpn-target
  peer 1.1.1.9 enable
 #
 ipv4-family vpn-instance vpn3
  import-route direct
  peer 10.1.1.2 as-number 65001
#
ospf 1
 area 0.0.0.0
  network 5.5.5.9 0.0.0.0
  network 192.2.1.0 0.0.0.255
#
return

Configuration file of CE1

#
 sysname CE1
#
interface GigabitEthernet1/0/0
 undo shutdown
 ip address 10.1.1.2 255.255.255.0
#
interface GigabitEthernet2/0/0
 undo shutdown
 ip address 10.2.1.2 255.255.255.0
#
bgp 65001
 peer 10.1.1.1 as-number 100
 peer 10.2.1.1 as-number 200
 #
 ipv4-family unicast
  undo synchronization
  import-route direct
  peer 10.1.1.1 enable
  peer 10.2.1.1 enable
#
return

Configuration file of CE2

#
 sysname CE2
#
interface GigabitEthernet1/0/0
 undo shutdown
 ip address 10.3.1.2 255.255.255.0
#
bgp 65002
 peer 10.3.1.1 as-number 100
 #
 ipv4-family unicast
  undo synchronization
  peer 10.3.1.1 enable
#
return

Hierarchy Of VPN - HoVPN

Hierarchical Model and Plane Model

On a BGP/MPLS IP VPN, as the key devices, PEs perform the following functions:

PEs ensure the access for users, and thus require a great number of interfaces.
PEs manage and advertise VPN routes, and process user packets. Thus, the PEs require large-capacity memory and high forwarding capabilities.

Currently, the hierarchical architecture is adopted by most networking schemes. For example, the typical architecture of a MAN consists of three layers: the core layer, convergence layer, and access layer. From the core layer to the access layer, the performance requirements for devices decline, but the network scale enlarges.

A BGP/MPLS IP VPN uses a plane model, which has the same performance requirement for all the PEs. If certain PEs have problems in performance or scalability, the whole network is affected.

The BGP/MPLS IP VPN plane model is not the same as the typical hierarchical model. In the plane model, deployment of PEs is hindered by poor scalability on each layer. Therefore, the plane model is unfavorable for VPN deployment on a large scale.

HoVPN

To improve scalability, a BGP/MPLS IP VPN must use the hierarchical model instead of the plane model.

In a Hierarchy of VPN (HoVPN), the functions of a PE are distributed among multiple PEs. Playing different roles, these PEs form a hierarchical architecture and fulfill the functions of a centralized PE. For this reason, the solution is also called a Hierarchy of PE (HoPE).

On an HoVPN, the routing and forwarding capabilities of the devices of higher levels must be stronger than those of lower levels.

Advantages of HoVPN

The HoVPN model has the following advantages:

A BGP/MPLS IP VPN can be divided into different hierarchies. If the performance of an underlayer PE (UPE) does not satisfy the requirements, a superstratum PE (SPE) can be added, and the UPE accesses the new SPE. When the service access capabilities of the SPE is insufficient, UPEs can be added to the SPE.
Label forwarding is performed between UPEs and SPEs. Thus, a UPE and an SPE need be connected through only a pair of interfaces or sub-interfaces. Thus, interface resources are saved.
If UPEs and SPEs are separated by an IP or MPLS network, GRE or LSP tunnels are set up to connect the UPEs and SPEs. A layered MPLS VPN features excellent scalability.
The UPEs need maintain only the local VPN routes. All the remote routes are represented by a default or aggregated route. This lightens the burden on the UPEs.
SPEs and UPEs exchange routes and advertise labels through the Multi-protocol Extensions for Border Gateway Protocol (MP-BGP). Each UPE sets up only one MP-BGP peer. Thus, the protocol cost is low and the configuration load is little.

Architecture of an HoVPN

Figure 1 Architecture of an HoVPN

As shown in Figure 1, the devices that are directly connected to user devices are called underlayer PEs or UPEs; on the internal network, the device that is connected to UPEs is called a superstratum PE or an SPE.

The relationships between the UPEs and the SPE are as follows:

The UPEs provide the access service for users. The UPEs maintain the routes of the directly connected VPN sites. The UPEs do not maintain the routes of the remote VPN sites, or only maintain their aggregation routes. The UPEs assign inner labels to the routes of the directly connected sites, and advertise the labels with the VPN routes to the SPE through MP-BGP.
The SPE mainly manages and advertises VPN routes. The SPE maintains all the routes of the VPN sites connected through the UPEs, including the routes of the local and the remote sites. Instead of advertising routes of the remote sites to the UPEs, the SPE advertises the default routes of VPN instances that carry labels to the UPEs.
Label forwarding is adopted between the UPEs and the SPE. Thus, only one interface of the SPE is required to connect to a UPE. The SPE does not need to provide many interfaces for access users. The interface that connects the UPEs and the SPE can be a physical interface, a sub-interface such as VLAN and Permanent Virtual Circuit (PVC), or a tunnel interface such as GRE and LSP. If a tunnel interface is used, and an IP network or an MPLS network resides between the SPE and the UPEs, the SPE and the UPEs can communicate. Labeled packets are transmitted through the tunnel. If the tunnel is a GRE tunnel, it must support the MPLS encapsulation.

Different roles of an SPE and a UPE result in different requirements, which are as follows: the SPE requires a large-capacity routing table, high forwarding performance, and less interface resources; the UPE requires a small-capacity routing table, low forwarding performance, and high access capabilities.

Note that the SPE and UPE are relative concepts. In an HoVPN, the superstratum PE is the SPE of the underlayer, and the underlayer PE is the UPE of the superstratum.

An HoPE can coexist with common PEs in an MPLS network.

SPE-UPE

If an SPE and a UPE belong to the same AS, MP-BGP running between the SPE and the UPE is MP-IBGP. If they belong to different ASs, MP-BGP running between them is MP-EBGP.

When MP-IBGP is used, to advertise routes between the IBGP peers, the SPE can function as the RR of multiple UPEs. To reduce the number of routes on the UPEs, the SPE is not recommended to function as an RR for other PEs.

Embedding and Extension of an HoVPN

An HoVPN supports the embedding of HoPEs.

An HoPE can function as a UPE, and compose a new HoPE with an SPE.
An HoPE can function as an SPE, and compose a new HoPE with multiple UPEs.
An HoPE can be embedded recursively in the preceding two modes.

The embedding of an HoPE can infinitely extend a VPN in theory.

Figure 2 Embedding of an HoVPN

Figure 2 shows a three-layer HoPE, and the PE in the middle is called the middle-level PE (MPE). MP-BGP runs between the SPE and the MPE, and between the MPE and the UPEs.

NOTE:

The MPE does not actually exist in an HoVPN model. The concept is introduced just for the convenience of description.

MP-BGP advertises all the VPN routes of the UPEs to the SPE, but advertises only the default routes of the VPN instances of the SPE to the UPEs.

The SPE maintains the routes of all VPN sites that the PEs access, whereas the UPE maintains only the VPN routes of the directly connected VPN sites. The numbers of routes maintained by the SPE, MPE, and UPE are in descending order.

Networking Applications

HoVPN extension

If an MPLS VPN spans a country, the VPN is generally of a flat structure, that is, the MPLS VPN services are provided through the backbone network. In the flat structure, the PEs of the backbone network are generally deployed in the central cities. The CEs are converged to a PE through one link respectively, as shown in Figure 3.

Figure 3 Networking diagram of a non-HoVPN

In this networking mode, a lot of resources of WAN links are consumed when the remote CEs access the central cities. The scale of the backbone network is limited, which leads to the poor scalability and limited coverage of the VPN.

On the contrary, if the HoVPN model is adopted, UPEs can be deployed even in counties, and the VPN users access the adjacent UPEs before being converged to the central cities, as shown in Figure 4. The coverage of the VPN can be extended. The services can be smoothly upgraded and the network can be extended as required. The SPEs and UPEs can reside within an AS or serve as joints between ASs.

Figure 4 Networking diagram of an HoVPN
UPE connected to multiple SPEs

The networking mode in which a UPE is connected to multiple SPEs is called multi-homed UPE. In this networking mode, the multiple SPEs advertise the VRF default routes to the UPE. The UPE selects one of the routes as the optimal route, or selects multiple routes to perform load balancing.

The UPE advertises all the VPN routes to the multiple SPEs, or just part of routes to each SPE to implement load balancing.
HoVPN of an inter-AS VPN
- As shown in Figure 5, the backbone network and the MANs belong to different ASs. The SPEs are deployed in the backbone network; the UPEs are deployed in the MANs. The UPEs advertise all the MAN routes to the SPEs; the SPEs advertise only the default routes of the VPN instances to the UPEs. Thus, the MANs need only maintain the routes of the internal VPN sites instead of the routes of sites outside the MANs. The backbone network must maintain the routes of all the VPN sites.
- In an inter-AS scheme, MP-EBGP or multi-hop EBGP can be adopted between SPEs and UPEs.
- In an inter-AS HoVPN, the high-level network, namely, the backbone network handles the global services; the low-level network, namely, the MAN need deal with only the local services. Thus, the global VPN service development does not challenge the capacity and extension of the low-level network.
Figure 5 Inter-AS HoVPN

Configure a CCC Local Connection

A local CCC connection refers to the connection between two local CEs, that is, two CEs connected to the same PE. Similar to a Layer 2 switch, the PE can switch traffic without the need to set up a static LSP.

Networking Requirements

Figure 1 shows the CE is connected with the PE through a POS interface. The packets are encapsulated in PPP over the link layer.

A local connection is created between CE1 and CE2.

Figure 1 Networking diagram of the local CCC connection

Configuration Roadmap

The configuration roadmap is as follows:

Configure basic MPLS capability on PE and enable the MPLS L2VPN.
Create a local connection from CE1 to CE2 on PE. (Because the local CCC connection is duplex, only one connection is needed.)

Data Preparation

To complete the configuration, you need the IP addresses of the interfaces.

Procedure

Configure CE.

# Configure CE1.

<HUAWEI> system-view

[HUAWEI] sysname CE1

[CE1] interface pos 1/0/0

[CE1-Pos1/0/0] ip address 100.1.1.1 24

[CE1-Pos1/0/0] undo shutdown

[CE1-Pos1/0/0] quit

# Configure CE2.

<HUAWEI> system-view

[HUAWEI] sysname CE2

[CE2] interface pos 1/0/0

[CE2-Pos1/0/0] ip address 100.1.1.2 24

[CE2-Pos1/0/0] undo shutdown

[CE2-Pos1/0/0] quit

Configure PE.

# Configure LSR IDs and enable MPLS and MPLS L2VPN.

<HUAWEI> system-view

[HUAWEI] sysname PE

[PE] interface loopback 1

[PE-LoopBack1] ip address 1.1.1.9 32

[PE-LoopBack1] quit

[PE] mpls lsr-id 1.1.1.9

[PE] mpls

[PE-mpls] quit

[PE] mpls l2vpn

[PE-l2vpn] quit

[PE] interface pos 1/0/0

[PE-Pos1/0/0] undo shutdown

[PE-Pos1/0/0] quit

[PE] interface pos 2/0/0

[PE-Pos2/0/0] undo shutdown

[PE-Pos2/0/0] quit

# Create the local connection from CE1 to CE2.

[PE] ccc ce1-ce2 interface pos 1/0/0 out-interface pos 2/0/0

Verify the configuration.

After the configuration is complete, run the display vll ccc command to view information about the CCC connection on the PE. You can find that a local CCC connection is set up on the PE, and the connection status is Up.

<PE> display vll ccc

total  ccc vc : 1

local  ccc vc : 1,  1 up

remote ccc vc : 0,  0 up

name: ce1-ce2, type: local, state: up,

intf1: Pos1/0/0 (up),   intf2: Pos2/0/0 (up)

VC last up time : 2008-07-24 12:31:31
VC total up time: 0 days, 2 hours, 12 minutes, 51 seconds

Run the display l2vpn ccc-interface vc-type ccc command, and you can find that the VC type is CCC and the status is Up.

<PE> display l2vpn ccc-interface vc-type all

Total ccc-interface of CCC : 2

up (2), down (0)

Interface                     Encap Type               State     VC Type

Pos1/0/0                       ppp                      up        ccc

Pos2/0/0                       ppp                      up        ccc

Run the display ip routing-table command on the CEs to check the interface routes learned on CE1 and CE2 from each other. CE1 and CE2 can successfully ping each other.

Take CE1 as an example:

<CE1> display ip routing-table

Route Flags: R - relay, D - download to fib

------------------------------------------------------------------------------

Routing Tables: Public

         Destinations : 5        Routes : 5

Destination/Mask    Proto  Pre  Cost     Flags NextHop         Interface

      100.1.1.0/24  Direct 0    0           D  100.1.1.1       Pos1/0/0

      100.1.1.1/32  Direct 0    0           D  127.0.0.1       InLoopBack0

      100.1.1.2/32  Direct 0    0           D  100.1.1.2       Pos1/0/0

      127.0.0.0/8   Direct 0    0           D  127.0.0.1       InLoopBack0

      127.0.0.1/32  Direct 0    0           D  127.0.0.1       InLoopBack0

<CE1> ping 100.1.1.2

  PING 100.1.1.2: 56  data bytes, press CTRL_C to break

    Reply from 100.1.1.2: bytes=56 Sequence=1 ttl=255 time=180 ms

    Reply from 100.1.1.2: bytes=56 Sequence=2 ttl=255 time=60 ms

    Reply from 100.1.1.2: bytes=56 Sequence=3 ttl=255 time=10 ms

    Reply from 100.1.1.2: bytes=56 Sequence=4 ttl=255 time=70 ms

    Reply from 100.1.1.2: bytes=56 Sequence=5 ttl=255 time=60 ms

  --- 100.1.1.2 ping statistics ---

    5 packet(s) transmitted

    5 packet(s) received

    0.00% packet loss

    round-trip min/avg/max = 10/76/180 ms

Configuration Files

Configuration file of CE1

 sysname CE1

interface Pos1/0/0

 link-protocol ppp

 undo shutdown

 ip address 100.1.1.1 255.255.255.0

return

Configuration file of the PE

 sysname PE

 mpls lsr-id 1.1.1.9

 mpls

 mpls l2vpn

interface Pos1/0/0

 link-protocol ppp

 undo shutdown

interface Pos2/0/0

 link-protocol ppp

 undo shutdown

 ccc ce1-ce2 interface Pos1/0/0 out-interface Pos2/0/0

interface LoopBack1

 ip address 1.1.1.9 255.255.255.255

return

Configuration file of CE2

 sysname CE2

interface Pos1/0/0

 link-protocol ppp

 undo shutdown

 ip address 100.1.1.2 255.255.255.0

return

Configuring a Martini VLL to Access an L3VPN

This part describes how to configure a Martini VLL in IP interworking mode to access the L3VPN.

Networking Requirements

As shown in Figure 1, the NPE and PE2 serve as the PE of IP/MPLS backbone network, and the UPE works as the PE on the VLL access network. CE1 accesses the MPLS L3VPN on the IP/MPLS backbone network through the VLL, and communicates with CE2. VE 2/0/0 and VE 2/0/1 are created on the NPE. with VE 2/0/0 being the L2VE interface to terminate the VLL and VE 2/0/1 being the L3VE interface to access the MPLS L3VPN.

The networking requirements are:

The PPP link is used between CE1 and the UPE.
The VLL is in Martini mode (IP internetworking).
VPN1 is the VPN instance of the MPLS L3VPN, with the route-distinguisher being 200:1, the vpn-target being 111:1, and the backbone network belonging to AS 100.
The NPE exchanges the VPN routing information with the peer PE (PE2) of the MPLS L3VPN by means of IBGP.
CE1 exchanges the VPN routing information with the NPE by means of EBGP; CE1 belongs to AS 65010.
CE1 exchanges the VPN routing information with PE2 by means of EBGP; CE2 belongs to AS 65020.

Figure 1 Networking diagram of the access of Martini VLL to MPLS L3VPN

Configuration Roadmap

The configuration roadmap is as follows:

Configure the MPLS L3VPN backbone network.
Create an L2VE interface on the NPE to terminate the VLL, and an L3VE interface on the NPE to access the L3VPN. Bind both interfaces to the same VE-group.
Configure the Martini VLL, which involves:
- Configure a routing protocol for the devices including the UPE, P, and the NPE on access network to make them communicate, and then enable MPLS.
- Use a tunnel policy (The default tunnel policy is used in this configuration example, that is, LSPs are established to transmit user data.)
- Enable MPLS L2VPN on the UPE and NPE, and establish VCs.
Configure the access of CE devices to the L3VPN. EBGP is used to exchange VPN routing information between CE1 and the NPE.

Data Preparations

To complete the configuration, you need the following data:

VE-group number
IP addresses of VE interfaces
Name of the VPN instance for MPLS L3VPN

Procedure

Configure an IP address for each interface. The configuration details are not mentioned here.

Configure the IP addresses for physical interfaces and loopback interfaces according to the configurations in Figure 1. The configuration details are not mentioned here.

Create VE 2/0/0 and VE 2/0/1 on the NPE, and bind them to the same VE-group.

# Create VE 2/0/0 to terminate the MPLS L2VPN.

<HUAWEI> system-view

[HUAWEI] sysname NPE

[NPE] interface virtual-ethernet2/0/0

[NPE-Virtual-Ethernet2/0/0] ve-group 1 l2-terminate

[NPE-Virtual-Ethernet2/0/0] quit

# Create VE 2/0/1 to access the MPLS L3VPN.

[NPE] interface virtual-ethernet2/0/1

[NPE-Virtual-Ethernet2/0/1] ve-group 1 l3-access

[NPE-Virtual-Ethernet2/0/1] quit

After the configuration is complete, run the display virtual-ethernet ve-group command. You can view the binding relationship between VE interfaces and a VE-group.

[NPE] display virtual-ethernet ve-group

 Ve-groupID    L2VE                        L3VE

 1               Virtual-Ethernet2/0/0   Virtual-Ethernet2/0/1

Total 1, 1 printed

Run an IGP on the VLL access network. OSPF is used in the example. The configuration details are not mentioned here.

When configuring OSPF, advertise the 32-bit Loopback interface addresses of the UPE, the P, and the NPE.

For specific configurations, see "Configuration Files".

Configure basic MPLS functions and LDP on the VLL access network.

# Configure the UPE.

<HUAWEI> system-view

[HUAWEI] sysname UPE

[UPE] mpls lsr-id 1.1.1.9

[UPE] mpls

[UPE-mpls] quit

[UPE] mpls ldp

[UPE-mpls-ldp] quit

[UPE] interface pos 2/0/0

[UPE-Pos2/0/0] mpls

[UPE-Pos2/0/0] mpls ldp

[UPE-Pos2/0/0] undo shutdown

[UPE-Pos2/0/0] quit

# Configure the P.

<HUAWEI> system-view

[HUAWEI] sysname P

[P] mpls lsr-id 2.2.2.9

[P] mpls

[P-mpls] quit

[P] mpls ldp

[P-mpls-ldp] quit

[P] interface pos 1/0/0

[P-Pos1/0/0] mpls

[P-Pos1/0/0] mpls ldp

[P-Pos1/0/0] undo shutdown

[P-Pos1/0/0] quit

[P] interface pos 2/0/0

[P-Pos2/0/0] mpls

[P-Pos2/0/0] mpls ldp

[P-Pos2/0/0] undo shutdown

[P-Pos2/0/0] quit

# Configure the NPE.

[NPE] mpls lsr-id 3.3.3.9

[NPE] mpls

[NPE-mpls] quit

[NPE] mpls ldp

[NPE-mpls-ldp] quit

[NPE] interface pos 2/0/0

[NPE-Pos2/0/0] mpls

[NPE-Pos2/0/0] mpls ldp

[NPE-Pos2/0/0] undo shutdown

[NPE-Pos2/0/0] quit

Establish remote LDP sessions between the NPE and the UPE.

# Configure the UPE.

[UPE] mpls ldp remote-peer 1

[UPE-mpls-ldp-remote-1] remote-ip 3.3.3.9

[UPE-mpls-ldp-remote-1] quit

# Configure the NPE.

[NPE] mpls ldp remote-peer 1

[NPE-mpls-ldp-remote-1] remote-ip 1.1.1.9

[NPE-mpls-ldp-remote-1] quit

Enable MPLS L2VPN on the PE, and establish VCs.

# Configure the UPE.

[UPE] mpls l2vpn

[UPE-l2vpn] mpls l2vpn default martini

[UPE-l2vpn] quit

[UPE] interface pos 1/0/0

[UPE-Pos1/0/0] mtu 1500

[UPE-Pos1/0/0] shutdown

[UPE-Pos1/0/0] undo shutdown

[UPE-Pos1/0/0] mpls l2vc 3.3.3.9 101 ip-interworking

[UPE-Pos1/0/0] ip address 100.1.1.2 24

[UPE-Pos1/0/0] quit

# Configure the NPE.

[NPE] mpls l2vpn

[NPE-l2vpn] mpls l2vpn default martini

[NPE-l2vpn] quit

[NPE] interface virtual-ethernet2/0/0.1
[NPE-Virtual-Ethernet2/0/0.1] vlan-type dot1q 1
[NPE-Virtual-Ethernet2/0/0.1] mpls l2vc 1.1.1.9 101 ip-interworking
[NPE-Virtual-Ethernet2/0/0.1] local-ce ip 100.1.1.2
[NPE-Virtual-Ethernet2/0/0.1] quit

After the configuration is complete, check the VLL connection between the UPE and the NPE. You can find that a static L2VC is established.

Take the display on the NPE as an example.

[NPE] display mpls l2vc

Total ldp vc : 1     1 up       0 down

 *Client Interface     : Virtual-Ethernet2/0/0.1

  Administrator PW     : no

  Session State        : up

  AC Status            : up

  VC State             : up

  VC ID                : 101

  VC Type              : ip-interworking

  Destination          : 1.1.1.9

  local VC label       : 140288       remote VC label      : 140292

  control word         : disable

  forwarding entry     : exist

  local group ID       : 0

  manual fault         : not set

  active state         : active

  link state           : up

  local VC MTU         : 1500         remote VC MTU        : 1500

  tunnel policy name   : --

  traffic behavior name: --

  PW template name     : --

  primary or secondary : primary

  create time          : 0 days, 0 hours, 30 minutes, 18 seconds

  up time              : 0 days, 0 hours, 0 minutes, 0 seconds

  last change time     : 0 days, 0 hours, 30 minutes, 18 seconds
  VC last up time : 2008/07/24 12:31:31
  VC total up time: 0 days, 2 hours, 12 minutes, 51 seconds

  CKey                 : 11                                                   
  NKey                 : 10

  AdminPw interface    : --
  AdminPw link state   : --

Run an IGP on the MPLS backbone network. IS-IS is used as the IGP protocol in this example. The configuration details are not mentioned here.

When configuring IS-IS, advertise the 32-bit loopback interface addresses of the PE2 and the NPE.

For specific configurations, see "Configuration Files".

Create VPN instances, and configure CEs to access the instances.

# Configure the NPE.

[NPE] ip vpn-instance VPN1

[NPE-vpn-instance-VPN1] ipv4-family

[NPE-vpn-instance-VPN1-af-ipv4] route-distinguisher 200:1

[NPE-vpn-instance-VPN1-af-ipv4] vpn-target 111:1 both

[NPE-vpn-instance-VPN1-af-ipv4] quit

[NPE-vpn-instance-VPN1] quit

[NPE] interface virtual-ethernet2/0/1.1
[NPE-Virtual-Ethernet2/0/1.1] vlan-type dot1q 1
[NPE-Virtual-Ethernet2/0/1.1] ip binding vpn-instance VPN1
[NPE-Virtual-Ethernet2/0/1.1] ip address 100.1.1.2 24
[NPE-Virtual-Ethernet2/0/1.1] quit

# Configure CE1.

<HUAWEI> system-view

[HUAWEI] sysname CE1

[CE1] interface pos 1/0/0

[CE1-Pos1/0/0] mtu 1500

[CE1-Pos1/0/0] shutdown

[CE1-Pos1/0/0] undo shutdown

[CE1-Pos1/0/0] ip address 100.1.1.1 24

[CE1-Pos1/0/0] quit

# Configure PE2.

<HUAWEI> system-view

[HUAWEI] sysname PE2

[PE2] ip vpn-instance VPN1

[PE2-vpn-instance-VPN1] ipv4-family

[PE2-vpn-instance-VPN1-af-ipv4] route-distinguisher 200:1

[PE2-vpn-instance-VPN1-af-ipv4] vpn-target 111:1 both

[PE2-vpn-instance-VPN1-af-ipv4] quit

[PE2-vpn-instance-VPN1] quit

[PE2] interface gigabitethernet1/0/0

[PE2-GigabitEthernet1/0/0] ip binding vpn-instance VPN1

[PE2-GigabitEthernet1/0/0] ip address 100.2.1.1 24

[PE2-GigabitEthernet1/0/0] undo shutdown

[PE2-GigabitEthernet1/0/0] quit

# Configure CE2.

<HUAWEI> system-view

[HUAWEI] sysname CE2

[CE2] interface gigabitethernet1/0/0

[CE2-GigabitEthernet1/0/0] ip address 100.2.1.2 24

[CE2-GigabitEthernet1/0/0] undo shutdown

[CE2-GigabitEthernet1/0/0] quit

After the configuration is complete, run the display ip vpn-instance verbose command on the NPE and PE2. You can view the configurations of the VPN instance. In addition, the NPE and PE can successfully ping the CE devices that they are connected to.

NOTE:

If the PE has multiple interfaces bound to the same VPN, and the ping -vpn-instance command is used to ping the CE device that the peer PE accesses, you need to specify the source IP address; that is, specify the -a source-ip-address in the ping -vpn-instance vpn-instance-name -a source-ip-address dest-ip-address command; otherwise, the ping command fails.

Take the display on the NPE as an example:

[NPE] display ip vpn-instance verbose

  Total VPN-Instances configured : 1

  VPN-Instance Name and ID : VPN1, 1

 Address family ipv4

  Create date : 2007-09-21 11:30:35

  Up time : 0 days, 00 hours, 05 minutes and 19 seconds

  Route Distinguisher : 200:1

  Export VPN Targets :  111:1

  Import VPN Targets :  111:1

  Label policy: label per route

  The diffserv-mode Information is : uniform

  The ttl-mode Information is : pipe

  Log Interval : 5

  Interfaces : Virtual-Ethernet2/0/1.1

[NPE] ping -vpn-instance VPN1 100.1.1.1

  PING 100.1.1.1: 56  data bytes, press CTRL_C to break

    Reply from 100.1.1.1: bytes=56 Sequence=1 ttl=255 time=56 ms

    Reply from 100.1.1.1: bytes=56 Sequence=2 ttl=255 time=4 ms

    Reply from 100.1.1.1: bytes=56 Sequence=3 ttl=255 time=4 ms

    Reply from 100.1.1.1: bytes=56 Sequence=4 ttl=255 time=52 ms

    Reply from 100.1.1.1: bytes=56 Sequence=5 ttl=255 time=3 ms

  --- 100.1.1.1 ping statistics ---

    5 packet(s) transmitted

    5 packet(s) received

    0.00% packet loss

    round-trip min/avg/max = 3/23/56 ms

Set up EBGP peer relationships between PEs and CEs, and import VPN routes.

# Configure CE1.

[CE1] bgp 65010

[CE1-bgp] peer 100.1.1.2 as-number 100

[CE1-bgp] import-route direct

# Configure CE2.

[CE2] bgp 65020

[CE2-bgp] peer 100.2.1.1 as-number 100

[CE2-bgp] import-route direct

# Configure the NPE.

[NPE] bgp 100

[NPE-bgp] ipv4-family vpn-instance VPN1

[NPE-bgp-VPN1] peer 100.1.1.1 as-number 65010

[NPE-bgp-VPN1] import-route direct

[NPE-bgp-VPN1] quit

# Configure PE2.

[PE2] bgp 100

[PE2-bgp] ipv4-family vpn-instance VPN1

[PE2-bgp-VPN1] peer 100.2.1.2 as-number 65020

[PE2-bgp-VPN1] import-route direct

[PE2-bgp-VPN1] quit

Set up MP-IBGP peer relationships between the NPE and PE2.

# Configure the NPE.

[NPE] bgp 100

[NPE-bgp] peer 4.4.4.9 as-number 100

[NPE-bgp] peer 4.4.4.9 connect-interface loopback 1

[NPE-bgp] ipv4-family vpnv4

[NPE-bgp-af-vpnv4] peer 4.4.4.9 enable

[NPE-bgp-af-vpnv4] quit

# Configure PE2.

[PE2] bgp 100

[PE2-bgp] peer 3.3.3.9 as-number 100

[PE2-bgp] peer 3.3.3.9 connect-interface loopback 1

[PE2-bgp] ipv4-family vpnv4

[PE2-bgp-af-vpnv4] peer 3.3.3.9 enable

[PE2-bgp-af-vpnv4] quit

Verify the configuration.

CE1 and CE2 can ping each other successfully. Take the display on CE1 as example:

[CE1] ping 100.2.1.2

  PING 100.2.1.2: 56  data bytes, press CTRL_C to break

    Reply from 100.2.1.2: bytes=56 Sequence=1 ttl=255 time=31 ms

    Reply from 100.2.1.2: bytes=56 Sequence=2 ttl=255 time=10 ms

    Reply from 100.2.1.2: bytes=56 Sequence=3 ttl=255 time=5 ms

    Reply from 100.2.1.2: bytes=56 Sequence=4 ttl=255 time=2 ms

    Reply from 100.2.1.2: bytes=56 Sequence=5 ttl=255 time=28 ms

  --- 100.2.1.2 ping statistics ---

    5 packet(s) transmitted

    5 packet(s) received

    0.00% packet loss

    round-trip min/avg/max = 2/15/31 ms

Configuration Files

Configuration file of the UPE

 sysname UPE

 mpls lsr-id 1.1.1.9

 mpls

 mpls l2vpn

  mpls l2vpn default martini

mpls ldp

 mpls ldp remote-peer 1

 remote-ip 3.3.3.9

interface Pos1/0/0

 mtu 1500

 undo shutdown

 link-protocol ppp

 ip address 100.1.1.2 255.255.255.0

 mpls l2vc 3.3.3.9 101 ip-interworking

interface Pos2/0/0

 undo shutdown

 link-protocol ppp

 ip address 10.2.1.1 255.255.255.0

 mpls

 mpls ldp

interface LoopBack1

 ip address 1.1.1.9 255.255.255.255

ospf 1

 area 0.0.0.0

  network 1.1.1.9 0.0.0.0

  network 10.2.1.0 0.0.0.255

return

Configuration file of P

 sysname P

 mpls lsr-id 2.2.2.9

 mpls

mpls ldp

interface Pos1/0/0

 undo shutdown

 link-protocol ppp

 ip address 10.2.2.1 255.255.255.0

 mpls

 mpls ldp

interface Pos2/0/0

 undo shutdown

 link-protocol ppp

 ip address 10.2.1.2 255.255.255.0

 mpls

 mpls ldp

interface LoopBack1

 ip address 2.2.2.9 255.255.255.255

ospf 1

 area 0.0.0.0

  network 2.2.2.9 0.0.0.0

  network 10.2.1.0 0.0.0.255

  network 10.2.2.0 0.0.0.255

return

Configuration file of the NPE

 sysname NPE

ip vpn-instance VPN1

 ipv4-family

 route-distinguisher 200:1

 vpn-target 111:1 export-extcommunity

 vpn-target 111:1 import-extcommunity

 mpls lsr-id 3.3.3.9

 mpls

 mpls l2vpn

  mpls l2vpn default martini

mpls ldp

 mpls ldp remote-peer 1

 remote-ip 1.1.1.9

isis 1

 network-entity 10.0000.0000.0001.00

interface Pos1/0/0

 undo shutdown

 link-protocol ppp

 ip address 10.3.3.1 255.255.255.0

 isis enable 1

 mpls

 mpls ldp

interface Pos2/0/0

 undo shutdown

 link-protocol ppp

 ip address 10.2.2.2 255.255.255.0

 mpls

 mpls ldp

interface Virtual-Ethernet2/0/0
 ve-group 1 l2-terminate

#
interface Virtual-Ethernet2/0/0.1
 vlan-type dot1q 1
 local-ce ip 100.1.1.2
 mpls l2vc 1.1.1.9 101 ip-interworking

interface Virtual-Ethernet2/0/1

 ve-group 1 l3-access

#
interface Virtual-Ethernet2/0/1.1
 vlan-type dot1q 1
 ip binding vpn-instance VPN1
 ip address 100.1.1.2 255.255.255.0

interface LoopBack1

 ip address 3.3.3.9 255.255.255.255

 isis enable 1

bgp 100

 peer 4.4.4.9 as-number 100

 peer 4.4.4.9 connect-interface LoopBack1

 ipv4-family unicast

  undo synchronization

  peer 4.4.4.9 enable

 ipv4-family vpnv4

  policy vpn-target

  peer 4.4.4.9 enable

ipv4-family vpn-instance VPN1

  peer 100.1.1.1 as-number 65010

  import-route direct

ospf 1

 area 0.0.0.0

  network 3.3.3.9 0.0.0.0

  network 10.2.2.0 0.0.0.255

return

Configuration file of PE2

 sysname PE2

ip vpn-instance VPN1

 ipv4-family

 route-distinguisher 200:1

 vpn-target 111:1 export-extcommunity

 vpn-target 111:1 import-extcommunity

 mpls lsr-id 4.4.4.9

 mpls

mpls ldp

isis 1

 network-entity 10.0000.0000.0002.00

interface GigabitEthernet1/0/0

 undo shutdown

 ip binding vpn-instance VPN1

 ip address 100.2.1.1 255.255.255.0

interface Pos1/0/0

 undo shutdown

 link-protocol ppp

 ip address 10.3.3.2 255.255.255.0

 isis enable 1

 mpls

 mpls ldp

interface LoopBack1

 ip address 4.4.4.9 255.255.255.255

 isis enable 1

bgp 100

 peer 3.3.3.9 as-number 100

 peer 3.3.3.9 connect-interface LoopBack1

 ipv4-family unicast

  undo synchronization

  peer 3.3.3.9 enable

 ipv4-family vpnv4

  policy vpn-target

  peer 3.3.3.9 enable

ipv4-family vpn-instance VPN1

  peer 100.2.1.2 as-number 65020

  import-route direct

return

Configuration file of CE1

 sysname CE1

interface Pos1/0/0

 mtu 1500

 undo shutdown

 link-protocol ppp

 ip address 100.1.1.1 255.255.255.0

bgp 65010

 peer 100.1.1.2 as-number 100

ipv4-family unicast

 undo synchronization

 import-route direct

 peer 100.1.1.2 enable

Return

Configuration file of CE2

 sysname CE2

interface GigabitEthernet1/0/0

 undo shutdown

 ip address 100.2.1.2 255.255.255.0

bgp 65020

 peer 100.2.1.1 as-number 100

ipv4-family unicast

 undo synchronization

 import-route direct

 peer 100.2.1.1 enable

return

Pages

Configuring Load Balancing Among EBGP and IBGP Routes When CEs Are Dual-Homed

Networking Requirements

Configuration Roadmap

Data Preparation

Procedure

Configuration Files

Hierarchy Of VPN - HoVPN

Hierarchy Of VPN - HoVPN

Hierarchical Model and Plane Model

HoVPN

Advantages of HoVPN

Architecture of an HoVPN

SPE-UPE

Embedding and Extension of an HoVPN

Networking Applications

Configure a CCC Local Connection

Networking Requirements

Configuration Roadmap

Data Preparation

Procedure

Configuration Files

Configuring a Martini VLL to Access an L3VPN

Networking Requirements

Configuration Roadmap

Data Preparations

Procedure

Configuration Files