Login
- Table of Contents
-
- 10-Segment Routing Configuration Guide
- 00-Preface
- 01-SR-MPLS configuration
- 02-SR-MPLS TE policy configuration
- 03-SRv6 configuration
- 04-SRv6 TE policy configuration
- 05-SRv6 VPN overview
- 06-IP L3VPN over SRv6 configuration
- 07-EVPN L3VPN over SRv6 configuration
- 08-Public network IP over SRv6 configuration
- 09-SRv6 OAM configuration
- 10-EVPN VPLS over SRv6 configuration
- 11-EVPN VPWS over SRv6 configuration
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 06-IP L3VPN over SRv6 configuration | 361.59 KB |
Configuring IP L3VPN over SRv6
Intercommunication between SRv6 and EVPN VXLAN networks
IP L3VPN over SRv6 tasks at a glance
Applying a locator to a BGP VPN instance
Configuring PEs to exchange BGP VPNv4 or VPNv6 routes
Configuring IPv6 peers to exchange SRv6 SIDs
Configuring next hop-based dynamic End.DX4 or End.DX6 SID allocation for private network routes
Configuring BGP VPNv4 or VPNv6 routes
Restrictions and guidelines for BGP VPNv4 or VPNv6 route configuration
Controlling BGP VPNv4 or VPNv6 route advertisement and reception
Setting a preferred value for received BGP VPNv4 or VPNv6 routes
Configuring BGP VPNv4 or VPNv6 route reflection
Configuring BGP VPNv4 or VPNv6 route attributes
Configuring BGP VPNv4 or VPNv6 route distribution filtering policies
Configuring the BGP Additional Paths feature
Configuring BGP to preferentially use the routes learned from a peer or peer group
Configuring the route recursion mode
Specifying a source address for the outer IPv6 header of SRv6-encapsulated packets
Enabling SRv6 VPN compatibility for a peer or peer group
Enabling intercommunication between SRv6 and EVPN VXLAN networks
About intercommunication between SRv6 and EVPN VXLAN networks
Enabling BGP VPNv4 or VPNv6 route advertisement for the BGP EVPN address family
Enabling BGP EVPN route advertisement for the BGP VPNv4 or VPNv6 address family
Configuring IP L3VPN over SRv6 FRR
Configuring SBFD for SRv6 locators
Configuring a TTL processing mode for tunnels associated with a VPN instance
Verifying and maintaining IP L3VPN over SRv6
Displaying the configuration and running status of IP L3VPN over SRv6 VPN
Clearing flap statistics for BGP VPNv4 routes
IP L3VPN over SRv6 configuration examples
Example: Configuring IP L3VPN over SRv6 in SRv6-BE mode
Configuring IP L3VPN over SRv6
About IP L3VPN over SRv6
IP L3VPN over SRv6 uses SRv6 tunnels to carry IP L3VPN services. This technology establishes SRv6 tunnels among geographically dispersed customer sites over an IPv6 network and transparently forwards Layer 3 customer traffic to remote sites over the IPv6 network through the tunnels. For more information about MPLS L3VPN configuration, see MPLS Configuration Guide.
Basic principle
Figure 1 shows a typical IP L3VPN over SRv6 network.
· PE 1 and PE 2 use BGP to advertise IPv4 or IPv6 VPN routes to each other over the IPv6 backbone network. The VPN routes contain private network routing information and SID information.
· The PEs have an SRv6 tunnel between them and they use the SRv6 tunnel to forward VPN traffic across sites.
· The devices in the IPv6 backbone network forward the SRv6-encapsulated VPN traffic through the optimal path calculated by IGP.
IP L3VPN over SRv6 connects geographically dispersed sites that belong to the same VPN over the IPv6 backbone network.
Route advertisement
The route advertisement process of IPv4 L3VPN over SRv6 is similar to that of IPv6 L3VPN over SRv6. This section uses IPv4 L3VPN over SRv6 to illustrate the process.
As shown in Figure 1, local routes of CE 1 are advertised to CE 2 by using the following process:
1. CE 1 uses static routing, RIP, OSPF, IS-IS, EBGP, or IBGP to advertise private network routes of the local site to PE 1.
2. After learning the route information of CE 1, PE 1 stores the private routes to the routing table of the VPN instance. In this example, VPN instance 1 is used. Then, PE 1 converts the routes to BGP VPNv4 routes and advertises the BGP VPNv4 routes to PE 2 by using MP-BGP. The BGP VPNv4 routes carry the RD, RT, and SID attributes (the SID attribute is used as the private network label). All private network routes of the VPN instance are allocated the same End.DT4 or End.DT46 SID.
3. When PE 2 receives the routes advertised by PE 1, it adds the routes to the routing table of VPN 1, converts the routes to IPv4 routes, and advertises the IPv4 routes to CE 2.
4. By adding the received IPv4 routes to the routing table, CE 2 learns the private network routes of CE 1.
Packet forwarding
The packet forwarding process is similar for IPv4 L3VPN over SRv6 and IPv6 L3VPN over SRv6. This section uses IPv4 L3VPN over SRv6 and VPN sites to illustrate the process.
As shown in Figure 1, CE 2 forwards an IPv4 packet to CE 1 as follows:
1. CE 2 sends the IPv4 packet to PE 2.
2. PE 2 receives the packet on an interface associated with VPN 1. PE 2 searches for a route that matches the destination IPv4 address of the packet in the routing table of VPN 1. The corresponding End.DT4 or End.DT46 SID is found. Then, PE 2 encapsulates an outer IPv6 header for the packet. The End.DT4 or End.DT46 SID is encapsulated in the outer IPv6 header as the destination address.
3. PE 2 searches the IPv6 routing table based on the End.DT4 or End.DT46 SID for the optimal IGP route and forwards the packet to P through the route.
4. P searches the IPv6 routing table based on the End.DT4 or End.DT46 SID for the optimal IGP route and forwards the packet to PE 1 through the route.
5. When PE 1 receives the packet, it processes the packet as follows:
a. Searches the local SID forwarding table for the End.DT4 or End.DT46 SID.
b. Removes the outer IPv6 header.
c. Matches the packet to VPN 1 based on the SID, searches the routing table of VPN 1 for the optimal route, and forwards the packet to CE 1.
Intercommunication between SRv6 and EVPN VXLAN networks
As shown in Figure 2, EVPN VXLAN is deployed at each site for inter-site Layer 2 connectivity and EVPN gateways are deployed for Layer 3 connectivity across sites. The sites are connected by an IP L3VPN over SRv6 network. To ensure connectivity between the sites over the IP L3VPN over SRv6 network, enable intercommunication between SRv6 and EVPN VXLAN networks on the border devices.
Figure 2 Network diagram for intercommunication between SRv6 and EVPN VXLAN networks
When intercommunication between SRv6 and EVPN VXLAN networks is enabled on a border device, the border device processes routes as follows:
· When the border device receives EVPN IP prefix advertisement routes from the EVPN VXLAN network, it matches the route targets with the local import route targets. If a matching VPN instance is found, the border device adds the routes to the routing table of the matching VPN instance. Then, the border device allocates an SRv6 SID to the routes and converts the routes to VPNv4 or VPNv6 routes based on the VPN instance configuration. Finally, the border device advertises the VPNv4 or VPNv6 routes that include an SRv6 SID to the IP L3VPN over SRv6 network.
· When the border device receives VPNv4 or VPNv6 routes from the IP L3VPN over SRv6 network, it matches the route targets with the local import route targets. If a matching VPN instance is found, the border device adds the routes to the routing table of the matching VPN instance. Then, the border device allocates an L3 VXLAN ID to the routes and converts the routes to EVPN IP prefix advertisement routes based on the VPN instance configuration. Finally, the border device advertises the EVPN IP prefix advertisement routes to the EVPN VXLAN network.
Figure 3 Packet forwarding between SRv6 and EVPN VXLAN networks
After the VTEPs and border devices finish route learning, packets from Site 2 to Site 1 are forwarded as follows:
1. When VTEP 2 receives packets from Site 2, it adds VXLAN encapsulation to the packets and forwards the packets to Border 2. The VXLAN ID encapsulated in the packets is the L3 VXLAN ID.
2. Border 2 performs the following operations:
a. Identifies the VPN instance of the packets based on the L3 VXLAN ID.
b. Removes the VXLAN encapsulation.
c. Looks up the routing table of the VPN instance for a matching route.
d. Adds an SRv6 SID to the packets and encapsulates other SRv6 information to the packets.
e. Forwards the packets to Border 1 in SRv6-BE or SRv6-TE mode.
3. Border 1 performs the following operations:
a. Identifies the VPN instance of the packets based on the SRv6 SID.
b. Removes the SRv6 encapsulation.
c. Looks up the routing table of the VPN instance.
d. Adds VXLAN encapsulation to the packets. The VXLAN ID encapsulated in the packets is the L3 VXLAN ID.
e. Forwards the packets to VTEP 1.
4. When VTEP 1 receives the packets, it removes the VXLAN encapsulation and forwards the packets to CE 1.
IP L3VPN over SRv6 FRR
|
|
IMPORTANT: IP L3VPN over SRv6 FRR is supported only when the customer sites belong to VPNs. |
IP L3VPN over SRv6 Fast Reroute (FRR) is applicable to a dualhomed scenario, as shown in Figure 4. By using static BFD to detect the primary link, FRR enables a PE to use the backup link when the primary link fails. The PE then selects a new optimal route, and uses the new optimal route to forward traffic.
IP L3VPN over SRv6 supports VPNv4 route backup for a VPNv4 route and VPNv6 route backup for a VPNv6 route.
Figure 4 Network diagram of VPNv4 route backup for a VPNv4 route
IPv4 L3VPN over SRv6 and IPv6 L3VPN over SRv6 use the same FRR mechanism. This section uses VPNv4 route backup for a VPNv4 route as an example to illustrate the mechanism.
As shown in Figure 4, configure FRR on the ingress node PE 1, and specify the backup next hop for VPN 1 as PE 3. When PE 1 receives a VPNv4 route to CE 2 from both PE 2 and PE 3, it uses the route from PE 2 as the primary link, and the route from PE 3 as the backup link.
Configure static BFD for public tunnels on PE 1 to detect the connectivity of the public tunnel from PE 1 to PE 2. When the tunnel PE 1—PE 2 operates correctly, traffic from CE 1 to CE 2 goes through the path CE 1—PE 1—PE 2—CE 2. When the tunnel fails, the traffic goes through the path CE 1—PE 1—PE 3—CE 2.
In this scenario, PE 1 is responsible for primary link detection and traffic switchover.
For more information about static BFD, see BFD configuration in High Availability Configuration Guide.
IP L3VPN over SRv6 tasks at a glance
To configure IP L3VPN over SRv6, perform the following tasks:
1. Configuring a VPN instance and associating interfaces connected to CEs with the VPN instance
Perform this task on PEs. For more information, see MPLS L3VPN in MPLS Configuration Guide.
2. Configuring route exchange between a PE and a CE
Configure an IPv4 routing protocol (static routing, RIP, OSPF, IS-IS, EBGP, or IBGP) or an IPv6 routing protocol (IPv6 static routing, RIPng, OSPFv3, IPv6 IS-IS, EBGP, or IBGP) to exchange routes between a PE and a CE
On the CE, configure an IPv4 or IPv6 routing protocol to advertise routes of the local site to the PE. On the PE, associate the routing protocol with the VPN instance. For more information about routing protocol configurations, see Layer 3—IP Routing Configuration Guide.
3. Configuring route exchange between PEs
Perform this task to manually configure End.DT4, End.DT6, End.DT46, End.DX4, or End.DX6 SIDs.
b. Applying a locator to a BGP VPN instance
BGP can advertise SRv6 SIDs through BGP routes only after you apply a locator to BGP.
c. Configuring PEs to exchange BGP VPNv4 or VPNv6 routes
d. Configuring IPv6 peers to exchange SRv6 SIDs
This feature enables PEs to exchange End.DT4, End.DT6, End.DT46, End.DX4, or End.DX6 SIDs through BGP VPNv4 or VPNv6 routes.
e. (Optional.) Configuring next hop-based dynamic End.DX4 or End.DX6 SID allocation for private network routes
This feature enables a PE to dynamically allocate End.DX4 or End.DX6 SIDs to BGP private network routes based on the route next hops.
f. (Optional.) Configuring BGP VPNv4 or VPNv6 routes
4. Configuring the route recursion mode
5. Specifying a source address for the outer IPv6 header of SRv6-encapsulated packets
This feature specifies the source address of the outer IPv6 header for SRv6 packets that are delivered between two private network sites over the backbone network.
6. (Optional.) Enabling SRv6 VPN compatibility for a peer or peer group
7. (Optional.) Enabling intercommunication between SRv6 and EVPN VXLAN networks
8. (Optional.) Configuring IP L3VPN over SRv6 FRR
9. (Optional.) Configuring SBFD for SRv6 locators
10. (Optional.) Configuring a TTL processing mode for tunnels associated with a VPN instance
Configuring SRv6 SIDs
Restrictions and guidelines
If PEs advertise BGP VPNv4 or VPNv6 routes to each other, you must specify a VPN instance when configuring an opcode.
Procedure
1. Enter system view.
system-view
2. Enable SRv6 and enter SRv6 view.
segment-routing ipv6
3. Configure a locator and enter SRv6 locator view.
locator locator-name [ ipv6-prefix ipv6-address prefix-length [ args args-length | static static-length ] * ]
4. Configure an opcode. Perform one of the following tasks:
¡ Configure End.DT4 SIDs.
opcode { opcode | hex hex-opcode } end-dt4 [ vpn-instance vpn-instance-name ]
The specified VPN instance must exist. The same End.DT4 SIDs cannot be configured in different VPN instances.
¡ Configure End.DT6 SIDs.
opcode { opcode | hex hex-opcode } end-dt6 [ vpn-instance vpn-instance-name ]
The specified VPN instance must exist. The same End.DT6 SIDs cannot be configured in different VPN instances.
¡ Configure End.DT46 SIDs.
opcode { opcode | hex hex-opcode } end-dt46 [ vpn-instance vpn-instance-name ]
The specified VPN instance must exist. The same End.DT46 SIDs cannot be configured in different VPN instances.
¡ Configure End.DX4 SIDs.
opcode { opcode | hex hex-opcode } end-dx4 interface interface-type interface-number nexthop nexthop-ipv4-address [ vpn-instance vpn-instance-name ]
The specified VPN instance must exist. The same End.DX4 SIDs cannot be configured with different output interfaces or next hops.
¡ Configure End.DX6 SIDs.
opcode { opcode | hex hex-opcode } end-dx6 interface interface-type interface-number nexthop nexthop-ipv6-address [ vpn-instance vpn-instance-name ]
The specified VPN instance must exist. The same End.DX6 SIDs cannot be configured with different output interfaces or next hops.
Applying a locator to a BGP VPN instance
About this task
Use this feature in BGP-VPN IPv4 or IPv6 unicast address family view of a VPN instance to apply for SRv6 SIDs for the private network routes of the VPN instance.
Use this feature if the device will use End.DT4, End.DT6, End.DT46, End.DX4, or End.DX6 SIDs to deliver VPN traffic across sites.
Restrictions and guidelines
The VPN instance of the specified locator must be the same as the VPN instance of the private network. To specify a VPN instance for a locator, use the opcode end-dt4, opcode end-dt6, opcode end-dt46, opcode end-dx4, or opcode end-dx6 command in SRv6 locator view.
Prerequisites
Before you perform this task, you must create the specified locator.
Procedure
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP-VPN instance view.
ip vpn-instance vpn-instance-name
4. Enter BGP-VPN IPv4 unicast address family view or BGP-VPN IPv6 unicast address family view.
¡ Enter BGP-VPN IPv4 unicast address family view.
address-family ipv4 [ unicast ]
¡ Enter BGP-VPN IPv6 unicast address family view.
address-family ipv6 [ unicast ]
5. Apply a locator to the BGP VPN instance.
¡ Apply a common locator to the BGP VPN instance.
segment-routing ipv6 locator locator-name [ auto-sid-disable ]
¡ Apply an anycast locator to the BGP VPN instance.
segment-routing ipv6 locator locator-name anycast
After configuring this command, you must configure the peer prefix-sid command with the anycast keyword in order to exchange SRv6 SID information in the anycast locator with the specified peer.
By default, no locator is applied to a BGP VPN instance.
Configuring PEs to exchange BGP VPNv4 or VPNv6 routes
Restrictions and guidelines
For more information about the commands in this section, see BGP in Layer 3—IP Routing Command Reference.
To ensure optimal route selection and SRv6 tunnel traffic forwarding, make sure a pair of PEs are not both IPv4 and IPv6 peers to each other.
Procedure
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Specify a remote PE as an IPv6 peer.
peer { group-name | ipv6-address [ prefix-length ] } as-number as-number
4. Specify a source interface (IPv6 address) for establishing TCP connections to an IPv6 peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } connect-interface interface-type interface-number
By default, BGP uses the output interface in the optimal route destined for a BGP peer or peer group as the source interface for establishing TCP connections.
5. Create the BGP VPNv4 or VPNv6 address family and enter its view.
¡ Create the BGP VPNv4 address family and enter its view.
address-family vpnv4
¡ Create the BGP VPNv6 address family and enter its view.
address-family vpnv6
6. Enable BGP to exchange VPNv4 or VPNv6 routing information with an IPv6 peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } enable
By default, BGP cannot exchange VPNv4 or VPNv6 routing information with an IPv6 peer or peer group.
Configuring IPv6 peers to exchange SRv6 SIDs
About this task
Perform this task to configure IPv6 peers to exchange SRv6 SID information through BGP VPNv4 or VPNv6 routes.
Procedure
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
¡ Enter BGP VPNv4 address family view.
address-family vpnv4
¡ Enter BGP VPNv6 address family view.
address-family vpnv6
4. Enable BGP to exchange SRv6 SID information with an IPv6 peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } prefix-sid [ anycast ]
By default, BGP cannot exchange SRv6 SID information with an IPv6 peer or peer group.
After specifying the anycast keyword, you must configure the segment-routing ipv6 locator anycast command in order to exchange SRv6 SID information in the anycast locator with the specified peer.
Configuring next hop-based dynamic End.DX4 or End.DX6 SID allocation for private network routes
About this task
Perform this task to forward an SRv6 decapsulated VPN packet to the next hop without looking up the routing table of the VPN instance.
By default, all BGP private network routes of a VPN instance are allocated the SID of the VPN instance. When a PE removes the SRv6 encapsulation from a received packet, it looks up the routing table of the VPN instance based on the SID for an optimal route. Then, the PE forwards the packet to a CE. To forward the packet to the next hop without looking up the routing table of the VPN instance, perform this task.
This task dynamically allocates End.DX4 or End.DX6 SIDs to all or specific next hops of the BGP private network routes in a VPN instance based on the next hop addresses. When forwarding a packet, the PE searches for the output interface and next hop based on the End.DX4 or End.DX6 SID of the packet. Then, the PE directly forwards the packet out of the output interface to the next hop.
Restrictions and guidelines
This feature does not allocate End.DX4 or End.DX6 SIDs to direct routes.
Prerequisites
Before you perform this task in BGP-VPN IPv4 or IPv6 unicast address family view, execute the segment-routing ipv6 locator command in the same view to apply a locator to the view. This ensures successful dynamic End.DX4 or End.DX6 SID allocation.
Procedure
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP-VPN instance view.
ip vpn-instance vpn-instance-name
4. Enter BGP-VPN IPv4 unicast address family view or BGP-VPN IPv6 unicast address family view.
¡ Enter BGP-VPN IPv4 unicast address family view.
address-family ipv4 [ unicast ]
¡ Enter BGP-VPN IPv6 unicast address family view.
address-family ipv6 [ unicast ]
5. Allocate End.DX4 or End.DX6 SIDs to the next hops of BGP private network routes.
¡ Allocate End.DX4 or End.DX6 SIDs to all next hops of BGP private network routes.
segment-routing ipv6 apply-sid all-nexthop
¡ Execute the following commands in sequence to allocate an End.DX4 or End.DX6 SID to the specified next hop of BGP private network routes.
segment-routing ipv6 apply-sid specify-nexthop
nexthop nexthop-address interface interface-type interface-number
By default, VPN instance-based SID allocation is used for private network routes.
Configuring BGP VPNv4 or VPNv6 routes
Restrictions and guidelines for BGP VPNv4 or VPNv6 route configuration
For more information about the commands in this section, see BGP in Layer 3—IP Routing Command Reference.
Controlling BGP VPNv4 or VPNv6 route advertisement and reception
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
¡ Enter BGP VPNv4 address family view.
address-family vpnv4
¡ Enter BGP VPNv6 address family view.
address-family vpnv6
4. Set the maximum number of routes that BGP can receive from a peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } route-limit prefix-number [ { alert-only | discard | reconnect reconnect-time } | percentage-value ] *
By default, the number of routes that BGP can receive from a peer or peer group is not limited.
5. Save all route updates from a peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } keep-all-routes
By default, route updates from peers and peer groups are not saved.
Setting a preferred value for received BGP VPNv4 or VPNv6 routes
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
¡ Enter BGP VPNv4 address family view.
address-family vpnv4
¡ Enter BGP VPNv6 address family view.
address-family vpnv6
4. Set a preferred value for routes received from a peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } preferred-value value
By default, the preferred value is 0 for routes received from a peer or peer group.
Configuring BGP VPNv4 or VPNv6 route reflection
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
¡ Enter BGP VPNv4 address family view.
address-family vpnv4
¡ Enter BGP VPNv6 address family view.
address-family vpnv6
4. Configure the router as a route reflector (RR) and specify a peer or peer group as its client.
peer { group-name | ipv6-address [ prefix-length ] } reflect-client
By default, no RR or client is configured.
5. (Optional.) Enable route reflection between clients.
reflect between-clients
By default, route reflection between clients is enabled.
6. (Optional.) Configure the cluster ID of the RR.
reflector cluster-id { cluster-id | ip-address }
By default, an RR uses its own router ID as the cluster ID.
7. (Optional.) Create an RR reflection policy.
rr-filter { ext-comm-list-number | ext-comm-list-name }
By default, an RR does not filter reflected routes.
8. (Optional.) Enable the RR to change the attributes of routes to be reflected.
reflect change-path-attribute
By default, the RR cannot change the attributes of routes to be reflected.
Configuring BGP VPNv4 or VPNv6 route attributes
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
¡ Enter BGP VPNv4 address family view.
address-family vpnv4
¡ Enter BGP VPNv6 address family view.
address-family vpnv6
4. Configure the NEXT_HOP attribute. Choose one of the following options:
¡ Specify the router as the next hop for routes sent to a peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } next-hop-local
¡ Configure the router to not change the next hop of routes advertised to a peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } next-hop-invariable
By default, the router sets itself as the next hop for routes sent to a peer or peer group.
The peer next-hop-local and peer next-hop-invariable commands are mutually exclusive.
5. Configure the AS_PATH attribute.
¡ Permit the local AS number to appear in routes from a peer or peer group and set the appearance times.
peer { group-name | ipv6-address [ prefix-length ] } allow-as-loop [ number ]
By default, the local AS number is not allowed in routes from a peer or peer group.
¡ Remove private AS numbers from the AS_PATH attribute of updates sent to an EBGP peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } public-as-only [ { force | limited } [ replace ] [ include-peer-as ] ]
By default, BGP updates sent to an EBGP peer or peer group can carry both public and private AS numbers.
6. Advertise the COMMUNITY attribute to a peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } advertise-community
By default, the COMMUNITY attribute is not advertised.
7. Configure the SoO attribute for a peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } soo site-of-origin
By default, no SoO attribute is configured for a peer or peer group.
8. Configure routing policy-based recursive lookup for BGP routes.
nexthop recursive-lookup route-policy route-policy-name
By default, BGP does not perform routing policy-based recursive lookup.
|
|
IMPORTANT: If no next hop routes obtained through recursion from the BGP routes in the address family match the specified routing policy, all the BGP routes in the address family become unreachable. Before configuring this command, plan the next hop routes for recursion in advance, and make sure the routes can match the permit-mode nodes in the specified routing policy. |
Configuring BGP VPNv4 or VPNv6 route distribution filtering policies
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
¡ Enter BGP VPNv4 address family view.
address-family vpnv4
¡ Enter BGP VPNv6 address family view.
address-family vpnv6
4. Specify an ACL or IP prefix list to filter advertised BGP routes.
filter-policy { ipv4-acl-number | name ipv4-acl-name | prefix-list prefix-list-name } export [ protocol process-id ]
By default, no ACL or IP prefix list is specified to filter advertised BGP routes.
5. Specify an ACL or IP prefix list to filter received BGP routes.
filter-policy { ipv4-acl-number | name ipv4-acl-name | prefix-list prefix-list-name } import
By default, no ACL or IP prefix list is specified to filter received BGP routes.
6. Specify an IP prefix list to filter BGP routes for a peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } prefix-list prefix-list-name { export | import }
By default, no IP prefix list is specified to filter BGP routes for a peer or peer group.
7. Apply a routing policy to routes received from or advertised to a peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } route-policy route-policy-name { export | import }
By default, no routing policy is applied to routes received from or advertised to a peer or peer group.
8. Enable route target filtering of received VPNv4 or VPNv6 routes.
policy vpn-target
By default, the route target filtering feature is enabled for received VPNv4 or VPNv6 routes. BGP adds an VPNv4 or VPNv6 route to the routing table only when the export route targets of the route match the local import route targets.
9. Filter BGP peers based on the first AS number in EBGP routes.
peer-as-check enable
By default, the device does not filter BGP peers based on the first AS number in EBGP routes. Upon receiving an EBGP route, the device advertises the route to all peers except the advertising peer.
With this command configured, BGP checks the first AS number in the AS_PATH attribute of EBGP routes. It will not advertise an EBGP route to a EBGP peer if the first AS number in the route is the same as the AS number of the EBGP peer.
Configuring the BGP Additional Paths feature
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
¡ Enter BGP VPNv4 address family view.
address-family vpnv4
¡ Enter BGP VPNv6 address family view.
address-family vpnv6
4. Configure the BGP Additional Paths capabilities.
peer { group-name | ipv6-address [ prefix-length ] } additional-paths { receive | send } *
By default, no BGP Additional Paths capabilities are configured.
5. Set the maximum number of Add-Path optimal routes that can be advertised to a peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } advertise additional-paths best number
By default, only one Add-Path optimal route can be advertised to a peer or peer group.
6. (Optional.) Set the optimal route selection delay timer.
route-select delay delay-value
By default, the optimal route selection delay timer is 0 seconds, which indicates that optimal route selection is not delayed.
Configuring BGP to preferentially use the routes learned from a peer or peer group
About this task
Perform this task to enable BGP to prefer the routes learned from a specific peer or peer group to the routes learned from other peers or peer groups. This route selection rule has lower priority than the rule that selects the route learned from EBGP, confederation EBGP, confederation IBGP, or IBGP in turn. In addition, this route selection rule has higher priority than the rule that selects the route with the smallest IGP metric.
For more information about BGP route selection rules, see BGP in Layer 3—IP Routing Configuration Guide.
Procedure
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
¡ Enter BGP VPNv4 address family view.
address-family vpnv4
¡ Enter BGP VPNv6 address family view.
address-family vpnv6
4. Configure BGP to preferentially use the routes learned from a peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } high-priority
By default, BGP does not preferentially use the routes learned from a peer or peer group.
Configuring the route recursion mode
About this task
After a PE receives a customer packet destined for an SRv6 SID, it forwards the packet according to the route recursion mode.
· SRv6-BE mode—This mode is also called SID-based forwarding mode. In this mode, the PE first encapsulates the End.DT4, End.DT6, or End.DT46 SID into the packet. Then, the PE searches the IPv6 routing table based on the SID encapsulated in the packet to forward the packet.
· SRv6-TE mode—This mode is also called SRv6 TE policy-based forwarding mode. In this mode, the PE first searches for a matching SRv6 TE policy based on the packet attributes. Then, the PE adds an SRH to the packet. The SRH includes the End.DT4, End.DT6, or End.DT46 SID and the SID list of the SRv6 TE policy. Finally, the PE forwards the encapsulated packet through the SRv6 TE policy. For more information, see "Configuring SRv6 TE policies."
· SRv6-TE and SRv6-BE hybrid mode—In this mode, the PE preferentially uses the SRv6-TE mode to forward the packet. If no SRv6 TE policy is available for the packet, the PE forwards the packet in SRv6-BE mode.
· SRv6 TE and SRv6 BE FRR mode—This mode implements FRR by using the SRv6 TE path (primary path) and SRv6 BE path (backup path). If the SRv6 TE path fails or does not exist, traffic is immediately switched to the SRv6 BE path to ensure service continuity.
Prerequisites
To use the SRv6-TE mode or the SRv6-TE and SRv6-BE hybrid mode, you must configure a tunnel policy and SRv6 TE policy. For more information, see tunnel policy configuration in MPLS Configuration Guide and "Configuring SRv6 TE policies."
Procedure
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP-VPN instance view.
ip vpn-instance vpn-instance-name
4. Enter BGP-VPN IPv4 unicast address family view or BGP-VPN IPv6 unicast address family view.
¡ Enter BGP-VPN IPv4 unicast address family view.
address-family ipv4 [ unicast ]
¡ Enter BGP-VPN IPv6 unicast address family view.
address-family ipv6 [ unicast ]
5. Configure the route recursion mode.
segment-routing ipv6 { best-effort | traffic-engineering | traffic-engineering best-effort | traffic-engineering best-effort-backup }
By default, a PE searches the IPv6 routing table based on the next hop of a matching route to forward traffic.
Specifying a source address for the outer IPv6 header of SRv6-encapsulated packets
Restrictions and guidelines
To ensure correct traffic forwarding in an IP L3VPN over SRv6 network, you must specify a source address for the outer IPv6 header of SRv6-encapsulated packets.
You cannot specify a loopback address, link-local address, multicast address, or unspecified address as the source IPv6 address. You must specify an IPv6 address of the local device as the source IPv6 address, and make sure the IPv6 address has been advertised by a routing protocol. As a best practice, specify a loopback interface address of the local device as the source IPv6 address.
Procedure
1. Enter system view.
system-view
2. Enter SRv6 view.
segment-routing ipv6
3. Specify a source address for the outer IPv6 header of SRv6-encapsulated packets.
encapsulation source-address ipv6-address [ ip-ttl ttl-value ]
By default, no source address is specified for the outer IPv6 header of SRv6-encapsulated packets.
Enabling SRv6 VPN compatibility for a peer or peer group
About this task
In an IP L3VPN over SRv6 network, PE devices from different vendors might use different formats to encrypt SRv6 SIDs in the VPNv4 or VPNv6 routes. As a result, the PE devices might fail to identify the received VPNv4 or VPNv6 routes, causing route advertisement failure. To resolve this issue, you can perform this task to change the SRv6 SID encryption format for BGP routes sent by H3C devices for interoperability with devices from other vendors.
Procedure
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
¡ Enter BGP VPNv4 address family view.
address-family vpnv4
¡ Enter BGP VPNv6 address family view.
address-family vpnv6
4. Enable SRv6 VPN compatibility for a peer or peer group.
peer { group-name | ipv6-address [ prefix-length ] } srv6-vpn compatible [ srv6-sid-transposition ]
By default, SRv6 VPN compatibility is disabled for a peer or peer group. The device encapsulates SRv6 SIDs for sent BGP routes in the non-Transposition-Scheme format as defined in draft-ietf-bess-srv6-services-07.
Enabling intercommunication between SRv6 and EVPN VXLAN networks
About intercommunication between SRv6 and EVPN VXLAN networks
When EVPN VXLAN is deployed within data centers and the data centers are interconnected through an IP L3VPN over SRv6 network, configure this feature on the border device for each data center. This feature enables intercommunication between the data centers.
Enabling BGP VPNv4 or VPNv6 route advertisement for the BGP EVPN address family
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP EVPN address family view.
address-family l2vpn evpn
4. Enable BGP VPNv4 or VPNv6 route advertisement for the BGP EVPN address family.
advertise l3vpn route [ replace-rt ][ advertise-policy policy-name ]
By default, BGP VPNv4 or VPNv6 routes are not advertised through the BGP EVPN address family.
This command enables the device to advertise BGP VPNv4 or VPNv6 routes as BGP EVPN IP prefix advertisement routes through the BGP EVPN address family.
For more information about this command, see EVPN-DCI commands in EVPN Command Reference.
Enabling BGP EVPN route advertisement for the BGP VPNv4 or VPNv6 address family
1. Enter system view.
system-view
2. Enter BGP instance view.
bgp as-number [ instance instance-name ]
3. Enter BGP VPNv4 address family view or BGP VPNv6 address family view.
address-family { vpnv4 | vpnv6 }
4. Enable BGP EVPN route advertisement for the BGP VPNv4 or VPNv6 address family.
advertise evpn route [ replace-rt ][ advertise-policy policy-name ]
By default, BGP EVPN routes are not advertised through the BGP VPNv4 or VPNv6 address family.
This command enables the device to advertise BGP EVPN IP prefix advertisement routes through the BGP VPNv4 or VPNv6 address family.
For more information about this command, see EVPN-DCI commands in EVPN Command Reference.
Configuring IP L3VPN over SRv6 FRR
About this task
IP L3VPN over SRv6 FRR enables the device to calculate backup routes for all routes of a VPN instance to reduce the traffic interruption caused by link or device failures on the backbone. If the device learns two unequal-cost routes destined for the same network from different peers, the optimal route is backed up by the other route. When the optimal route becomes unavailable, the device uses the backup route to forward traffic. At the same time, the device calculates a new optimal route and then uses it to direct traffic forwarding.
Restrictions and guidelines
This feature might cause routing loops in certain conditions. Make sure you are fully aware of this feature when you use it on a live network.
Procedure
1. Enter system view.
system-view
2. Configure static BFD.
bfd static session-name [ peer-ipv6 ipv6-address [ vpn-instance vpn-instance-name ] source-ipv6 ipv6-address [ discriminator local local-value remote remote-value ] [ track-interface interface-type interface-number ] ]
3. Return to system view.
quit
4. Enter BGP instance view.
bgp as-number [ instance instance-name ]
5. Configure BGP FRR to use BFD to detect next hop connectivity for the primary route.
primary-path-detect bfd echo
By default, BGP FRR uses ARP to detect the connectivity to the next hop of the primary route.
For more information about this command, see BGP commands in Layer 3—IP Routing Command Reference.
6. Enter BGP-VPN IPv4 unicast address family view, BGP VPNv4 address family view, BGP-VPN IPv6 unicast address family view, or BGP VPNv6 address family view.
¡ Execute the following commands in sequence to enter BGP-VPN IPv4 unicast address family view:
ip vpn-instance vpn-instance-name
address-family ipv4 [ unicast ]
¡ Enter BGP VPNv4 address family view.
address-family vpnv4
¡ Execute the following commands in sequence to enter BGP-VPN IPv6 unicast address family view:
ip vpn-instance vpn-instance-name
address-family ipv6 [ unicast ]
¡ Enter BGP VPNv6 address family view.
address-family vpnv6
7. Enable FRR for the address family.
pic
By default, FRR is disabled for a BGP address family.
For more information about this command, see BGP commands in Layer 3—IP Routing Command Reference.
Configuring SBFD for SRv6 locators
About this task
As shown in Figure 5, in the IP L3VPN over SRv6 BE scenario, CE 2 is dual homed to PE 2 and PE 3. After you enable FRR on PE 1, a primary path and a backup path are generated on PE 1. When the primary path fails, you can configure this feature for fast traffic switchover to the backup path. Use SBFD to detect connectivity of SRv6 locators advertised by PE 2 through BGP to fast locate primary path failures and switch traffic over to the backup path.
Figure 5 Using SBFD to detect SRv6 locators in a dual-homed network
SBFD detects the connectivity of SRv6 locators advertised by BGP as follows:
1. PE 1 sends SBFD packets as the initiator. The SRv6 locators are the destination addresses of the SBFD packets. The IP address specified in the sbfd source-ipv6 command is used as the source IP address of SBFD packets.
2. When PE 2 and PE 3 receive the SBFD packets as reflectors, they compare the remote discriminators in the packets with the locally configured discriminators.
¡ If they are consistent, the reflectors send SBFD response packets to the initiator through IPv6 routes.
¡ If they are inconsistent, the reflectors drop the received SBFD packets.
3. If the initiator can receive SBFD response packets before the detection timer expires, it determines that the SRv6 locators are reachable. If not, the initiator determines that the SRv6 locators are unreachable, and switches over to the backup path.
Restrictions and guidelines
To have this feature take effect, execute the sbfd destination ipv6 remote-discriminator command on PE 1 to configure the mappings between the detected SRv6 locators and remote discriminators. In addition, execute the sbfd local-discriminator command on PE 2 and PE 3 to configure the local discriminators on the reflector end. Make sure PE 1 have consistent discriminator settings with PE 2 and PE 3. For more information about the sbfd destination ipv6 remote-discriminator and sbfd local-discriminator commands, see BFD commands in High Availability Command Reference.
Procedure
1. Enter system view.
system-view
2. Enter SRv6 view.
segment-routing ipv6
3. Configure SBFD for SRv6 locators.
locator-sbfd enable [ template template-name ] [ prefix-list prefix-list-name ]
By default, SBFD is not configured for SRv6 locators.
Configuring a TTL processing mode for tunnels associated with a VPN instance
About this task
A tunnel associated with a VPN instance supports the following TTL processing modes:
· Pipe—When an IP or IPv6 packet enters the tunnel of the VPN instance, the ingress node adds a new header to the packet. The ingress node sets the TTL value or hop limit in the new header to 255 or the value specified by using the encapsulation source-address ip-ttl command in SRv6 view. When the packet leaves the tunnel of the VPN instance, the egress node removes the new header from the packet.The TTL value or hop limit in the original packet does not change when the packet is forwarded in the tunnel. Therefore, the public network nodes are invisible to user networks, and the tracert facility cannot show the real path in the public network.
· Uniform—When an IP or IPv6 packet enters the tunnel of the VPN instance, the ingress node adds a new header to the packet. The ingress node copies the TTL value or the hop limit of the original packet to the TTL or hop limit field of the new header. When the packet leaves the tunnel of the VPN instance, the egress node copies the remaining TTL value or hop limit in the new header back to the original packet. The TTL value or hop limit can reflect how many hops the packet has traversed in the public network. The tracert facility can show the real path along which the packet has traveled.
Restrictions and guidelines
In the current software version, you can configure a TTL processing mode only for SRv6 tunnels associated with VPN instances.
Procedure
1. Enter system view.
system-view
2. Enter VPN instance view.
ip vpn-instance vpn-instance-name [ index vpn-index ]
3. Configure a TTL processing mode for the tunnels associated with the VPN instance.
ttl-mode { pipe | uniform }
By default, the TTL processing mode for the tunnels associated with a VPN instance is pipe.
For more information about this command, see MPLS L3VPN configuration in MPLS Configuration Guide.
Verifying and maintaining IP L3VPN over SRv6
Displaying the configuration and running status of IP L3VPN over SRv6 VPN
For more information about the commands in this section, see basic BGP commands in Layer 3—IP Routing Command Reference.
Perform display tasks in any view.
· Display BGP VPNv4 peer or peer group information.
display bgp [ instance instance-name ] peer vpnv4 { ipv6-address prefix-length | ipv6-address { log-info | verbose } }
· Display BGP update group information for VPNv4 address family.
display bgp [ instance instance-name ] update-group vpnv4 ipv6-address
· Display BGP VPNv6 peer or peer group information.
display bgp [ instance instance-name ] peer vpnv6 [ vpn-instance vpn-instance-name ] [ ipv6-address prefix-length | { ipv6-address | group-name group-name } log-info | [ ipv6-address ] verbose ]
· Display BGP update group information for VPNv6 address family.
display bgp [ instance instance-name ] update-group vpnv6 [ vpn-instance vpn-instance-name ] [ ipv6-address ]
Resetting BGP sessions
About this task
For BGP setting changes to take effect, you must reset or soft-reset BGP sessions. Soft-resetting BGP sessions updates BGP routing information without tearing down the BGP sessions. Resetting BGP sessions updates BGP routing information by tearing down and re-establishing the BGP sessions. Soft-reset requires that both the local router and the peer support ROUTE-REFRESH messages.
Procedure
For more information about the commands, see basic BGP commands in Layer 3—IP Routing Command Reference.
Perform the tasks in user view.
· Soft-reset BGP sessions of the BGP VPNv4 address family.
refresh bgp [ instance instance-name ] ipv6-address [ prefix-length ] { export | import } vpnv4
· Reset BGP sessions of the BGP VPNv4 address family.
reset bgp [ instance instance-name ] ipv6-address [ prefix-length ] vpnv4
Clearing flap statistics for BGP VPNv4 routes
To clear flap statistics for BGP VPNv4 routes, execute the following command in user view:
reset bgp [ instance instance-name ] flap-info vpnv4 [ ipv4-address [ mask | mask-length ] | as-path-acl as-path-acl-number | peer ipv6-address [ prefix-length ] ]
IP L3VPN over SRv6 configuration examples
Example: Configuring IP L3VPN over SRv6 in SRv6-BE mode
Network configuration
As shown in Figure 6, the backbone network is an IPv6 network, and VPN 1 is an IPv4 network. Deploy IP L3VPN over SRv6 between PE 1 and PE 2 and use an SRv6 tunnel to transmit VPNv4 traffic between the PEs.
· Configure EBGP to exchange VPN routing information between the CEs and PEs.
· Configure IPv6 IS-IS on the PEs in the same AS to realize IPv6 network connectivity.
· Configure MP-IBGP to exchange VPNv4 routing information between the PEs.
Table 1 Interface and IP address assignment
|
Device |
Interface |
IP address |
Device |
Interface |
IP address |
|
CE 1 |
HGE1/0/1 |
10.1.1.2/24 |
PE 2 |
Loop0 |
3::3/128 |
|
PE 1 |
Loop0 |
1::1/128 |
|
HGE1/0/1 |
10.2.1.1/24 |
|
|
HGE1/0/1 |
10.1.1.1/24 |
|
HGE1/0/2 |
2002::1/96 |
|
|
HGE1/0/2 |
2001::1/96 |
CE 2 |
HGE1/0/1 |
10.2.1.2/24 |
|
P |
Loop0 |
2::2/128 |
|
|
|
|
|
HGE1/0/1 |
2001::2/96 |
|
|
|
|
|
HGE1/0/2 |
2002::2/96 |
|
|
|
Prerequisites
By default, interfaces on the device are disabled (in ADM or Administratively Down state). To have an interface operate, you must use the undo shutdown command to enable that interface.
Procedure
1. Configure IPv6 IS-IS on the PEs and device P for network connectivity between the devices:
# Configure PE 1.
<PE1> system-view
[PE1] isis 1
[PE1-isis-1] is-level level-1
[PE1-isis-1] cost-style wide
[PE1-isis-1] network-entity 10.1111.1111.1111.00
[PE1-isis-1] address-family ipv6 unicast
[PE1-isis-1-ipv6] quit
[PE1-isis-1] quit
[PE1] interface loopback 0
[PE1-LoopBack0] ipv6 address 1::1 128
[PE1-LoopBack0] isis ipv6 enable 1
[PE1-LoopBack0] quit
[PE1] interface hundredgige 1/0/2
[PE1-HundredGigE1/0/2] ipv6 address 2001::1 96
[PE1-HundredGigE1/0/2] isis ipv6 enable
[PE1-HundredGigE1/0/2] quit
# Configure P.
<P> system-view
[P] isis
[P-isis-1] is-level level-1
[P-isis-1] cost-style wide
[P-isis-1] network-entity 10.2222.2222.2222.00
[P-isis-1] address-family ipv6 unicast
[P-isis-1-ipv6] quit
[P-isis-1] quit
[P] interface loopback 0
[P-LoopBack0] ipv6 address 2::2 128
[P-LoopBack0] isis ipv6 enable
[P-LoopBack0] quit
[P] interface hundredgige 1/0/1
[P-HundredGigE1/0/1] ipv6 address 2001::2 96
[P-HundredGigE1/0/1] isis ipv6 enable
[P-HundredGigE1/0/1] quit
[P] interface hundredgige 1/0/2
[P-HundredGigE1/0/2] ipv6 address 2002::2 96
[P-HundredGigE1/0/2] isis ipv6 enable
[P-HundredGigE1/0/2] quit
# Configure PE 2.
<PE2> system-view
[PE2] isis
[PE2-isis-1] is-level level-1
[PE2-isis-1] cost-style wide
[PE2-isis-1] network-entity 10.3333.3333.3333.00
[PE2-isis-1] address-family ipv6 unicast
[PE2-isis-1-ipv6] quit
[PE2-isis-1] quit
[PE2] interface loopback 0
[PE2-LoopBack0] ipv6 address 3::3 128
[PE2-LoopBack0] isis ipv6 enable
[PE2-LoopBack0] quit
[PE2] interface hundredgige 1/0/2
[PE2-HundredGigE1/0/2] ipv6 address 2002::1 96
[PE2-HundredGigE1/0/2] isis ipv6 enable
[PE2-HundredGigE1/0/2] quit
# Verify that PE 1, P, and PE 2 have established IPv6 IS-IS neighbor relationships and the neighbor state is up.
[PE1] display isis peer
[P] display isis peer
[PE2] display isis peer
# Verify that PE 1 and PE 2 each learn a route destined for the loopback interface of each other.
[PE1] display isis route ipv6
[PE2] display isis route ipv6
2. Configure VPN instance settings on PE 1 and PE 2 and verify that each CE can access its local PE:
# Configure PE 1.
[PE1] ip vpn-instance vpn1
[PE1-vpn-instance-vpn1] route-distinguisher 100:1
[PE1-vpn-instance-vpn1] vpn-target 111:1
[PE1-vpn-instance-vpn1] quit
[PE1] interface hundredgige 1/0/1
[PE1-HundredGigE1/0/1] ip binding vpn-instance vpn1
[PE1-HundredGigE1/0/1] ip address 10.1.1.1 24
[PE1-HundredGigE1/0/1] quit
# Configure PE 2.
[PE2] ip vpn-instance vpn1
[PE2-vpn-instance-vpn1] route-distinguisher 100:1
[PE2-vpn-instance-vpn1] vpn-target 111:1
[PE2-vpn-instance-vpn1] quit
[PE2] interface hundredgige 1/0/1
[PE2-HundredGigE1/0/1] ip binding vpn-instance vpn1
[PE2-HundredGigE1/0/1] ip address 10.2.1.1 24
[PE2-HundredGigE1/0/1] quit
# Configure IP addresses for the interfaces on the CEs, as shown in Figure 6. (Details not shown.)
# Display VPN instance settings on each PE. This step uses PE 1 as an example.
[PE1] display ip vpn-instance
Total VPN-Instances configured : 1
Total IPv4 VPN-Instances configured : 1
Total IPv6 VPN-Instances configured : 1
VPN-Instance Name RD Address family Create time
vpn1 100:1 N/A 2019/08/12 13:59:39
# Verify that each PE can ping its local CE. This step uses PE 1 and CE 1 as an example.
[PE1] ping -vpn-instance vpn1 10.1.1.2
Ping 10.1.1.2 (10.1.1.2): 56 data bytes, press CTRL+C to break
56 bytes from 10.1.1.2: icmp_seq=0 ttl=255 time=2.000 ms
56 bytes from 10.1.1.2: icmp_seq=1 ttl=255 time=0.000 ms
56 bytes from 10.1.1.2: icmp_seq=2 ttl=255 time=1.000 ms
56 bytes from 10.1.1.2: icmp_seq=3 ttl=255 time=0.000 ms
56 bytes from 10.1.1.2: icmp_seq=4 ttl=255 time=0.000 ms
--- Ping statistics for 10.1.1.2 in VPN instance vpn1 ---
5 packet(s) transmitted, 5 packet(s) received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.000/0.600/2.000/0.800 ms
3. Set up an EBGP peer relationship between each PE and its local CE and distribute VPN routes to EBGP:
# Configure CE 1.
<CE1> system-view
[CE1] bgp 65410
[CE1-bgp-default] peer 10.1.1.1 as-number 100
[CE1-bgp-default] address-family ipv4 unicast
[CE1-bgp-default-ipv4] peer 10.1.1.1 enable
[CE1-bgp-default-ipv4] import-route direct
[CE1-bgp-default-ipv4] quit
[CE1-bgp-default] quit
# Configure CE 2 in the same way as CE 1 is configured. (Details not shown.)
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] router-id 1.1.1.1
[PE1-bgp-default] ip vpn-instance vpn1
[PE1-bgp-default-vpn1] peer 10.1.1.2 as-number 65410
[PE1-bgp-default-vpn1] address-family ipv4 unicast
[PE1-bgp-default-ipv4-vpn1] peer 10.1.1.2 enable
[PE1-bgp-default-ipv4-vpn1] quit
[PE1-bgp-default-vpn1] quit
# Configure PE 2 in the same way PE 1 is configured. (Details not shown.)
# Verify that the PEs have established BGP peer relationships with their local CEs and the peers are in established state.
[PE1] display bgp peer ipv4 vpn-instance
[PE2] display bgp peer ipv4 vpn-instance
4. Set up an MP-IBGP peer relationship between PE 1 and PE 2:
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] peer 3::3 as-number 100
[PE1-bgp-default] peer 3::3 connect-interface loopback 0
[PE1-bgp-default] address-family vpnv4
[PE1-bgp-default-vpnv4] peer 3::3 enable
[PE1-bgp-default-vpnv4] quit
[PE1-bgp-default] quit
# Configure PE 2.
[PE2] bgp 100
[PE2-bgp-default] peer 1::1 as-number 100
[PE2-bgp-default] peer 1::1 connect-interface loopback 0
[PE2-bgp-default] address-family vpnv4
[PE2-bgp-default-vpnv4] peer 1::1 enable
[PE2-bgp-default-vpnv4] quit
[PE2-bgp-default] quit
# Verify that the PEs have established a BGP peer relationship and the peers are in established state.
[PE1] display bgp peer vpnv4
[PE2] display bgp peer vpnv4
5. Specify a source address for the outer IPv6 header of SRv6-encapsulated packets on PE 1 and PE 2:
# Configure PE 1.
[PE1] segment-routing ipv6
[PE1-segment-routing-ipv6] encapsulation source-address 1::1
# Configure PE 2.
[PE2] segment-routing ipv6
[PE2-segment-routing-ipv6] encapsulation source-address 3::3
6. Configure the destination address (End.DT4 SID) of the outer IPv6 header for SRv6-encapsulated packets:
# Configure PE 1.
[PE1-segment-routing-ipv6] locator aaa ipv6-prefix 1:2::1:0 96 static 8
[PE1-segment-routing-ipv6-locator-aaa] quit
[PE1-segment-routing-ipv6] quit
[PE1] isis 1
[PE1-isis-1] address-family ipv6 unicast
[PE1-isis-1-ipv6] segment-routing ipv6 locator aaa
[PE1-isis-1-ipv6] quit
[PE1-isis-1] quit
# Configure PE 2.
[PE2-segment-routing-ipv6] locator bbb ipv6-prefix 6:5::1:0 96 static 8
[PE2-segment-routing-ipv6-locator-bbb] quit
[PE2-segment-routing-ipv6] quit
[PE2] isis 1
[PE2-isis-1] address-family ipv6 unicast
[PE2-isis-1-ipv6] segment-routing ipv6 locator bbb
[PE2-isis-1-ipv6] quit
[PE2-isis-1] quit
# Verify that the PEs have distributed the End.DT4 SIDs to the routing table and generated SRv6 routes. This step uses PE 1 as an example.
[PE1] display ipv6 routing-table protocol srv6
Summary count : 1
SRv6 Routing table status : <Active>
Summary count : 1
Destination: 1:2::101/128 Protocol : SRv6
NextHop : ::1 Preference: 4
Interface : InLoop0 Cost : 0
SRv6 Routing table status : <Inactive>
Summary count : 0
7. Add End.DT4 SIDs to private network routes on PE 1 and PE 2:
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] ip vpn-instance vpn1
[PE1-bgp-default-vpn1] address-family ipv4 unicast
[PE1-bgp-default-ipv4-vpn1] segment-routing ipv6 locator aaa
[PE1-bgp-default-ipv4-vpn1] quit
[PE1-bgp-default-vpn1] quit
[PE1-bgp-default] quit
# Configure PE 2.
[PE2] bgp 100
[PE2-bgp-default] ip vpn-instance vpn1
[PE2-bgp-default-vpn1] address-family ipv4 unicast
[PE2-bgp-default-ipv4-vpn1] segment-routing ipv6 locator bbb
[PE2-bgp-default-ipv4-vpn1] quit
[PE2-bgp-default-vpn1] quit
[PE2-bgp-default] quit
8. Enable IPv6 peers on the PEs to exchange End.DT4 SIDs and enable the SID-route-recursion feature:
# Configure PE 1.
[PE1] bgp 100
[PE1-bgp-default] address-family vpnv4
[PE1-bgp-default-vpnv4] peer 3::3 prefix-sid
[PE1-bgp-default-vpnv4] quit
[PE1-bgp-default] ip vpn-instance vpn1
[PE1-bgp-default-vpn1] address-family ipv4 unicast
[PE1-bgp-default-ipv4-vpn1] segment-routing ipv6 best-effort
[PE1-bgp-default-ipv4-vpn1] quit
[PE1-bgp-default-vpn1] quit
[PE1-bgp-default] quit
# Configure PE 2.
[PE2] bgp 100
[PE2-bgp-default] address-family vpnv4
[PE2-bgp-default-vpnv4] peer 1::1 prefix-sid
[PE2-bgp-default-vpnv4] quit
[PE2-bgp-default] ip vpn-instance vpn1
[PE2-bgp-default-vpn1] address-family ipv4 unicast
[PE2-bgp-default-ipv4-vpn1] segment-routing ipv6 best-effort
[PE2-bgp-default-ipv4-vpn1] quit
[PE2-bgp-default-vpn1] quit
[PE2-bgp-default] quit
# Display BGP VPNv4 routing information on each PE and verify that the routes advertised by the PEs have the SID attribute. This step uses PE 1 as an example.
[PE1] display bgp routing-table vpnv4 10.2.1.0
BGP local router ID: 1.1.1.1
Local AS number: 100
Route distinguisher: 100:1(vpn1)
Total number of routes: 1
Paths: 1 available, 1 best
BGP routing table information of 10.2.1.0/24:
From : 3::3 (3.3.3.3)
Rely nexthop : FE80::2A96:34FF:FE9D:216
Original nexthop: 3::3
Out interface : HundredGigE1/0/2
Route age : 00h14m23s
OutLabel : 3
Ext-Community : <RT: 111:1>
RxPathID : 0x0
TxPathID : 0x0
PrefixSID : End.DT4 SID <6:5::101>
AS-path : 65420
Origin : incomplete
Attribute value : MED 0, localpref 100, pref-val 0
State : valid, internal, best
IP precedence : N/A
QoS local ID : N/A
Traffic index : N/A
Tunnel policy : NULL
Rely tunnel IDs : N/A
Verifying the configuration
# Display IPv4 routing table information on the PEs and verify that each PE has a route destined for the remote CE and the next hop of the route is the End.DT4 SID of the route. This step uses PE 1 as an example.
[PE1] display ip routing-table vpn-instance vpn1
Destinations : 11 Routes : 11
Destination/Mask Proto Pre Cost NextHop Interface
0.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
10.1.1.0/24 Direct 0 0 10.1.1.1 HGE1/0/1
10.1.1.0/32 Direct 0 0 10.1.1.1 HGE1/0/1
10.1.1.1/32 Direct 0 0 127.0.0.1 InLoop0
10.1.1.255/32 Direct 0 0 10.1.1.1 HGE1/0/1
10.2.1.0/24 BGP 255 0 6:5::101 HGE1/0/2
127.0.0.0/8 Direct 0 0 127.0.0.1 InLoop0
127.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
127.0.0.1/32 Direct 0 0 127.0.0.1 InLoop0
127.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
255.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
# Verify that CE 1 and CE 2 can ping each other. (Details not shown.)
