Inter-AS Option B connects an L3VPN across two providers by exchanging the VPNv4 and VPNv6 routes over eBGP between the ASBRs. This eBGP session is in the global table and carries the VPN routes of all customers. Each ASBR allocates its own label for every route, and packets cross between the ASBRs with the assigned label. Since the initial route target stays with the route, two providers either have to agree on the customer’s RT or rewrite it at the ASBR.
CustA has three sites: HQ behind A-PE1 and Br1 behind A-PE2 in SP-A, and Br2 behind B-PE1 in SP-B. This time, the PE-CE protocol is OSPF. In the L3VPN post, Br2’s OSPF routing table had no routes from HQ or Br1, since no CustA route crossed between the providers.
In this stage, A-ASBR and B-ASBR exchange CustA’s routes over a second sub-interface on the link from the Option A post, and the three CustA PEs get the same OSPF domain ID.
At the end of the stage, Br2’s traceroute to HQ’s loopback looks as below:
CustA-Br2#traceroute 10.10.0.1 source lo0
Type escape sequence to abort.
Tracing the route to 10.10.0.1
VRF info: (vrf in name/id, vrf out name/id)
1 10.2.10.1 4 msec 2 msec 1 msec
2 10.2.1.25 [MPLS: Labels 16800/35 Exp 0] 5 msec 4 msec 8 msec
3 10.2.1.1 [MPLS: Labels 16800/35 Exp 0] 11 msec * 6 msec
4 10.2.1.42 [MPLS: Label 35 Exp 0] 4 msec 8 msec 5 msec
5 10.255.0.1 [MPLS: Label 1811 Exp 0] 5 msec 4 msec 4 msec
6 10.1.1.41 [MPLS: Labels 1103/1518 Exp 0] 4 msec 6 msec 6 msec
7 10.1.10.1 [MPLS: Label 1518 Exp 0] 5 msec 3 msec 4 msec
8 10.1.10.2 4 msec * 5 msecTopology file: topology.clab.yml · Addressing: ipam.md · Stage configs, 5 nodes (A-ASBR, B-ASBR, A-PE1, A-PE2, B-PE1): stage_configs/lab03-s4-interas-optb/
The Link Between the ASBRs
Gi4.255 is a dot1Q sub-interface on Gi4 in the global table, next to CustC’s Gi4.30:
A-ASBR#show run int gi4.255
Building configuration...
Current configuration : 155 bytes
!
interface GigabitEthernet4.255
encapsulation dot1Q 255
ip address 10.255.0.1 255.255.255.252
ipv6 address 2001:DB8:FF::1/64
mpls bgp forwarding
end
A-ASBR#show ip int br | i GigabitEthernet4
GigabitEthernet4 unassigned YES unset up up
GigabitEthernet4.30 10.255.0.5 YES TFTP up up
GigabitEthernet4.255 10.255.0.1 YES TFTP up upGi4 keeps the service instance from the Option A post, which makes the virtual NIC pass tagged frames to the routed sub-interfaces.
IOS-XE adds mpls bgp forwarding to Gi4.255 by itself when the VPN eBGP session over it comes up. No LDP runs between the providers, so MPLS on Gi4.255 is enabled for BGP only:
A-ASBR#show mpl interface
Interface IP Tunnel BGP Static Operational
GigabitEthernet2 Yes (ldp) No No No Yes
GigabitEthernet3 Yes (ldp) No No No Yes
GigabitEthernet4.255 No No Yes No YesKeeping the Routes on the ASBRs
CustA’s routes carry RT 64501:10 in SP-A and 64502:10 in SP-B, set in the L3VPN post. By default, IOS-XE keeps a VPN route only if one of its VRFs imports the route’s RT. The ASBRs have no CustA VRF, so no bgp default route-target filter is needed to keep CustA’s routes. It goes directly under router bgp, outside the address families, and covers both VPNv4 and VPNv6. On A-ASBR:
router bgp 64501
no bgp default route-target filterRewriting the Route Target
On A-ASBR, RM-OPTB-IN replaces 64502:10 with 64501:10 on the routes from B-ASBR, and RM-OPTB-OUT sends B-ASBR only the routes with 64501:10:
ip extcommunity-list standard CUSTA-SPB permit rt 64502:10
ip extcommunity-list standard CUSTA-SPA permit rt 64501:10
!
route-map RM-OPTB-IN permit 10
description Option B inbound: rewrite CustA RT 64502:10 -> 64501:10 (keep OSPF ext-comms)
match extcommunity CUSTA-SPB
set extcommunity rt 64501:10
!
route-map RM-OPTB-OUT permit 10
description Option B outbound: advertise ONLY CustA (64501:10); deny CustC 64501:30
match extcommunity CUSTA-SPAA-ASBR applies RM-OPTB-IN inbound and RM-OPTB-OUT outbound on its eBGP session to B-ASBR, in both VPN address families, as shown in the next section. B-ASBR has a similar configuration, rewriting 64501:10 to 64502:10.
eBGP Between the ASBRs
A-ASBR has one eBGP neighbour, B-ASBR’s 10.255.0.2:
router bgp 64501
neighbor 10.255.0.2 remote-as 64502
!
address-family vpnv4 unicast
neighbor 10.1.0.7 next-hop-self
neighbor 10.255.0.2 activate
neighbor 10.255.0.2 send-community extended
neighbor 10.255.0.2 route-map RM-OPTB-IN in
neighbor 10.255.0.2 route-map RM-OPTB-OUT out
exit-address-family
!
address-family vpnv6 unicast
neighbor 10.1.0.7 next-hop-self
neighbor 10.255.0.2 activate
neighbor 10.255.0.2 send-community extended
neighbor 10.255.0.2 route-map RM-OPTB-IN in
neighbor 10.255.0.2 route-map RM-OPTB-OUT out
exit-address-familyThe full files are A-ASBR.ios and B-ASBR.ios.
next-hop-self toward A-RR, 10.1.0.7, makes A-ASBR’s loopback the next hop of the routes from B-ASBR, since SP-A’s IGP has no route to B-ASBR’s address on the link. In both address families, A-ASBR has 2 prefixes from 10.255.0.2, Br2’s loopback and its PE-CE link:
A-ASBR#show bgp vpnv4 unicast all summary
BGP router identifier 10.1.0.8, local AS number 64501
BGP table version is 31, main routing table version 31
10 network entries using 2560 bytes of memory
10 path entries using 1360 bytes of memory
11/8 BGP path/bestpath attribute entries using 3256 bytes of memory
2 BGP rrinfo entries using 80 bytes of memory
3 BGP AS-PATH entries using 88 bytes of memory
13 BGP extended community entries using 744 bytes of memory
18 BGP route-map cache entries using 1152 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 9240 total bytes of memory
BGP activity 22/4 prefixes, 32/14 paths, scan interval 60 secs
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
10.1.0.7 4 64501 5757 6330 31 0 0 3d23h 5
10.255.0.2 4 64502 11 13 31 0 0 00:02:16 2
10.255.0.6 4 64502 6327 6328 31 0 0 3d23h 2
A-ASBR#show bgp vpnv6 unicast all summary
BGP router identifier 10.1.0.8, local AS number 64501
BGP table version is 17, main routing table version 17
8 network entries using 2240 bytes of memory
8 path entries using 1248 bytes of memory
9/6 BGP path/bestpath attribute entries using 2664 bytes of memory
2 BGP rrinfo entries using 80 bytes of memory
3 BGP AS-PATH entries using 88 bytes of memory
13 BGP extended community entries using 744 bytes of memory
18 BGP route-map cache entries using 1152 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 8216 total bytes of memory
BGP activity 22/4 prefixes, 32/14 paths, scan interval 60 secs
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
10.1.0.7 4 64501 5757 6330 17 0 0 3d23h 3
10.255.0.2 4 64502 11 13 17 0 0 00:02:23 2
2001:DB8:FF:30::2
4 64502 5759 5750 17 0 0 3d15h 210.255.0.6 and 2001:DB8:FF:30::2 are CustC’s sessions from the Option A post.
Br2’s Routes on A-ASBR
On A-ASBR, Br2’s loopback has only RT 64501:10, because set extcommunity rt without additive replaces the RTs on the route. The OSPF extended communities from B-PE1, DOMAIN ID, OSPF RT (the route type), and ROUTER ID, stay on the route:
A-ASBR#show bgp vpnv4 unicast rd 10.2.0.5:10 10.10.0.3/32
BGP routing table entry for 10.2.0.5:10:10.10.0.3/32, version 31
Paths: (1 available, best #1, no table)
Advertised to update-groups:
3
Refresh Epoch 1
64502
10.255.0.2 (via default) from 10.255.0.2 (10.2.0.8)
Origin incomplete, localpref 100, valid, external, best
Extended Community: RT:64501:10 OSPF DOMAIN ID:0x0005:0x00000000000A
OSPF RT:0.0.0.0:1:0 OSPF ROUTER ID:10.2.10.1:0
mpls labels in/out 1817/26
rx pathid: 0, tx pathid: 0x0The RD is still B-PE1’s, 10.2.0.5:10. mpls labels in/out 1817/26: B-ASBR advertised the route with label 26, and A-ASBR allocated its own label, 1817, for SP-A.
Br2’s IPv6 loopback has the same RT and OSPF domain ID. Its next hop is B-ASBR’s IPv4 address in IPv4-mapped form, ::FFFF:10.255.0.2, since VPNv6 runs over the IPv4 session:
A-ASBR#show bgp vpnv6 unicast rd 10.2.0.5:10 2001:db8:10::3/128
BGP routing table entry for [10.2.0.5:10]2001:DB8:10::3/128, version 17
Paths: (1 available, best #1, no table)
Advertised to update-groups:
1
Refresh Epoch 1
64502
::FFFF:10.255.0.2 (via default) from 10.255.0.2 (10.2.0.8)
Origin incomplete, localpref 100, valid, external, best
Extended Community: RT:64501:10 OSPF DOMAIN ID:0x0005:0x00000000000A
OSPF RT:0.0.0.0:2:0 OSPF ROUTER ID:10.2.0.5:0
mpls labels in/out 1824/28
rx pathid: 0, tx pathid: 0x0RM-OPTB-OUT keeps CustC on the Option A sub-interface. A-ASBR advertises four IPv4 routes to B-ASBR, from RDs 10.1.0.5:10 and 10.1.0.6:10:
A-ASBR#show bgp vpnv4 unicast all neigh 10.255.0.2 advertised-routes
BGP table version is 31, local router ID is 10.1.0.8
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
t secondary path, L long-lived-stale,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 10.1.0.5:10
*>i 10.1.10.0/30 10.1.0.5 0 100 0 ?
*>i 10.10.0.1/32 10.1.0.5 2 100 0 ?
Route Distinguisher: 10.1.0.6:10
*>i 10.1.10.4/30 10.1.0.6 0 100 0 ?
*>i 10.10.0.2/32 10.1.0.6 2 100 0 ?
Total number of prefixes 4OSPF Domain ID on the CustA PEs
Each PE redistributes CustA’s VPN routes from BGP into OSPF toward its CE. The route carries the OSPF domain ID of the PE that advertised it into BGP. If the receiving PE has the same domain ID, the CE gets the route as inter-area, O IA, from a Type-3 summary LSA. If the IDs differ, the CE gets it as external, O E2, from a Type-5 LSA.
IOS-XE sets a domain ID by default and IOS-XR does not, so B-PE1 would not match A-PE1 and A-PE2. All three PEs have the same domain ID configured, for OSPFv2 and OSPFv3. On A-PE1 and A-PE2:
router ospf 10 vrf CustA
domain-id type 0005 value 00000000000A
!
router ospfv3 10
address-family ipv6 unicast vrf CustA
domain-id type 0005 value 00000000000A
exit-address-family
!On B-PE1:
router ospf 10
vrf CustA
domain-id type 0005 value 00000000000A
!
!
router ospfv3 10
vrf CustA
domain-id type 0005 value 00000000000A
!
!B-PE1 has HQ’s loopback from B-RR with RT 64502:10, set by B-ASBR, and the domain ID set by A-PE1:
RP/0/RP0/CPU0:B-PE1#show bgp vpnv4 unicast vrf CustA 10.10.0.1/32
Mon Jul 20 05:07:55.058 UTC
BGP routing table entry for 10.10.0.1/32, Route Distinguisher: 10.2.0.5:10
Versions:
Process bRIB/RIB SendTblVer
Speaker 104 104
Last Modified: Jul 20 04:45:47.182 for 00:22:08
Paths: (1 available, best #1)
Not advertised to any peer
Path #1: Received by speaker 0
Not advertised to any peer
64501
10.2.0.8 (metric 30) from 10.2.0.7 (10.2.0.8)
Received Label 35
Origin incomplete, metric 0, localpref 100, valid, internal, best, group-best, import-candidate, imported
Received Path ID 0, Local Path ID 1, version 104
Extended community: OSPF domain-id:0x5:0x00000000000a OSPF route-type:0:2:0x0 OSPF router-id:10.1.10.1 RT:64502:10
Originator: 10.2.0.8, Cluster list: 10.2.0.7
Connector: type: 1, Value:10.1.0.5:10:10.1.0.5
Source AFI: VPNv4 Unicast, Source VRF: default, Source Route Distinguisher: 10.1.0.5:10In IPv4, Br2 has HQ’s and Br1’s loopbacks and PE-CE links as O IA. In IPv6, the two loopbacks are OI, OSPF inter-area:
CustA-Br2#show ip route ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
H - NHRP, G - NHRP registered, g - NHRP registration summary
o - ODR, P - periodic downloaded static route, l - LISP
a - application route
+ - replicated route, % - next hop override, p - overrides from PfR
& - replicated local route overrides by connected
Gateway of last resort is not set
10.0.0.0/8 is variably subnetted, 7 subnets, 2 masks
O IA 10.1.10.0/30 [110/11] via 10.2.10.1, 00:25:26, Ethernet0/1
O IA 10.1.10.4/30 [110/11] via 10.2.10.1, 00:25:26, Ethernet0/1
O IA 10.10.0.1/32 [110/11] via 10.2.10.1, 00:25:26, Ethernet0/1
O IA 10.10.0.2/32 [110/11] via 10.2.10.1, 00:25:26, Ethernet0/1
CustA-Br2#show ipv6 route ospf
IPv6 Routing Table - default - 6 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
B - BGP, R - RIP, H - NHRP, HG - NHRP registered
Hg - NHRP registration summary, HE - NHRP External, I1 - ISIS L1
I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
EX - EIGRP external, ND - ND Default, NDp - ND Prefix, DCE - Destination
NDr - Redirect, RL - RPL, O - OSPF Intra, OI - OSPF Inter
OE1 - OSPF ext 1, OE2 - OSPF ext 2, ON1 - OSPF NSSA ext 1
ON2 - OSPF NSSA ext 2, la - LISP alt, lr - LISP site-registrations
ld - LISP dyn-eid, lA - LISP away, le - LISP extranet-policy
lp - LISP publications, ls - LISP destinations-summary, a - Application
m - OMP
OI 2001:DB8:10::1/128 [110/11]
via FE80::E00:51FF:FE5E:3E03, Ethernet0/1
OI 2001:DB8:10::2/128 [110/11]
via FE80::E00:51FF:FE5E:3E03, Ethernet0/1Forwarding
In B-ASBR’s forwarding table, CustA’s routes leave on Gi4.255 with A-ASBR’s labels, 1810 to 1813 for IPv4 and 1818 and 1819 for IPv6. CustC’s route, label 18, leaves on Gi4.30 without a label:
B-ASBR#show mpls forwarding-table
Local Outgoing Prefix Bytes Label Outgoing Next Hop
Label Label or Tunnel Id Switched interface
16 Pop Label 10.2.1.45-A 0 Gi3 10.2.1.45
17 Pop Label 10.2.1.45-A 0 Gi3 10.2.1.45
18 No Label 10.30.0.1/32[V] 3000 Gi4.30 10.255.0.5
19 Pop Label 10.2.1.41-A 0 Gi2 10.2.1.41
20 Pop Label 10.2.1.41-A 0 Gi2 10.2.1.41
21 1818 [167837701:10]2001:DB8:10::1/128 \
0 Gi4.255 10.255.0.1
22 1819 [167837702:10]2001:DB8:10::2/128 \
0 Gi4.255 10.255.0.1
25 24011 10.2.0.5:10:10.2.10.0/30 \
0 Gi2 10.2.1.41
26 24012 10.2.0.5:10:10.10.0.3/32 \
9564 Gi2 10.2.1.41
27 24004 [167903237:10]2001:DB8:2:20::/64 \
0 Gi2 10.2.1.41
28 24005 [167903237:10]2001:DB8:10::3/128 \
1220 Gi2 10.2.1.41
29 24006 [167903237:30]2001:DB8:30::2/128 \
0 Gi2 10.2.1.41
30 24010 [167903238:30]2001:DB8:30::3/128 \
0 Gi3 10.2.1.45
33 No Label 2001:DB8:30::1/128[V] \
0 Gi4.30 FE80::E00:1FFF:FE4E:9303
34 1810 10.1.0.5:10:10.1.10.0/30 \
0 Gi4.255 10.255.0.1
35 1811 10.1.0.5:10:10.10.0.1/32 \
0 Gi4.255 10.255.0.1
36 1812 10.1.0.6:10:10.1.10.4/30 \
0 Gi4.255 10.255.0.1
37 1813 10.1.0.6:10:10.10.0.2/32 \
0 Gi4.255 10.255.0.1
16100 Pop Label 10.2.0.1/32 0 Gi2 10.2.1.41
16200 16200 10.2.0.2/32 0 Gi2 10.2.1.41
16300 16300 10.2.0.3/32 0 Gi2 10.2.1.41
16300 10.2.0.3/32 0 Gi3 10.2.1.45
16400 Pop Label 10.2.0.4/32 0 Gi3 10.2.1.45
16500 16500 10.2.0.5/32 0 Gi2 10.2.1.41
16600 16600 10.2.0.6/32 0 Gi3 10.2.1.45
16700 16700 10.2.0.7/32 0 Gi2 10.2.1.41
A - Adjacency SIDCustA-Br2#traceroute 10.10.0.1 source lo0
Type escape sequence to abort.
Tracing the route to 10.10.0.1
VRF info: (vrf in name/id, vrf out name/id)
1 10.2.10.1 4 msec 2 msec 1 msec
2 10.2.1.25 [MPLS: Labels 16800/35 Exp 0] 5 msec 4 msec 8 msec
3 10.2.1.1 [MPLS: Labels 16800/35 Exp 0] 11 msec * 6 msec
4 10.2.1.42 [MPLS: Label 35 Exp 0] 4 msec 8 msec 5 msec
5 10.255.0.1 [MPLS: Label 1811 Exp 0] 5 msec 4 msec 4 msec
6 10.1.1.41 [MPLS: Labels 1103/1518 Exp 0] 4 msec 6 msec 6 msec
7 10.1.10.1 [MPLS: Label 1518 Exp 0] 5 msec 3 msec 4 msec
8 10.1.10.2 4 msec * 5 msecIn Br2’s traceroute above:
- Hop 1, B-PE1, receives a plain IP packet from Br2, looks up 10.10.0.1 in VRF CustA and sends it to B-P2 with two labels: 16800, B-ASBR’s prefix-SID, and 35, the label B-ASBR advertised for HQ’s loopback.
- Hop 2, B-P2, receives 16800 and 35 under it.
- Hop 3, B-P1, receives the same two labels and removes 16800 before sending the packet to B-ASBR.
- Hop 4, B-ASBR, receives only 35 and sends the packet out Gi4.255 with 1811.
- Hop 5, A-ASBR, receives 1811 on Gi4.255. A-ASBR’s entry for 1811 sends the packet to A-P1 with 1518, the label A-PE1 advertised for HQ’s loopback, under 1103, A-P1’s label for A-PE1’s loopback.
- Hop 6, A-P1, receives 1103 and 1518 under it, and removes 1103.
- Hop 7, A-PE1, receives only 1518 and sends the packet to HQ.
- Hop 8, HQ, receives a plain IP packet.
In the Option A post, B-ASBR received Core1’s packet on the same link without a label.
In IPv6, B-ASBR swaps 21 for 1818, and A-ASBR receives 1818 at hop 5:
CustA-Br2#traceroute 2001:db8:10::1 source lo0
Type escape sequence to abort.
Tracing the route to 2001:DB8:10::1
1 2001:DB8:2:20::1 5 msec 7 msec 1 msec
2 ::FFFF:10.2.1.25 [MPLS: Labels 16800/21 Exp 0] 6 msec 3 msec 6 msec
3 2001:DB8:2:10::1 [MPLS: Labels 16800/21 Exp 0] 39 msec 5 msec 5 msec
4 ::FFFF:10.2.1.42 [MPLS: Label 21 Exp 0] 7 msec 4 msec 4 msec
5 ::FFFF:10.255.0.1 [MPLS: Label 1818 Exp 0] 6 msec 3 msec *
6 ::FFFF:10.1.1.41 [MPLS: Labels 1103/1519 Exp 0] 12 msec 3 msec 3 msec
7 2001:DB8:1:20::1 [MPLS: Label 1519 Exp 0] 6 msec 3 msec 4 msec
8 2001:DB8:1:20::2 3 msec 4 msec 4 msecBr2 pings HQ in both address families, and HQ and Br1 ping Br2:
CustA-Br2#ping 10.10.0.1 source lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.0.1, timeout is 2 seconds:
Packet sent with a source address of 10.10.0.3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/10 ms
CustA-Br2#ping 2001:db8:10::1 source lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:10::1, timeout is 2 seconds:
Packet sent with a source address of 2001:DB8:10::3
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/8 msCustA-HQ#ping 10.10.0.3 source lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.0.3, timeout is 2 seconds:
Packet sent with a source address of 10.10.0.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 3/4/6 msCustA-Br1#ping 10.10.0.3 source lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.0.3, timeout is 2 seconds:
Packet sent with a source address of 10.10.0.2
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/6 msWhat’s Next
The next post moves CustA’s multicast VPN in SP-A from Profile 0 to Profile 11.
Leave a Reply