Inter-AS VPN Model C
This chapter provides information about inter-autonomous system (AS) virtual private network (VPN) model C.
Topics in this chapter include:
Applicability
The CLI in the latest update of this chapter corresponds to SR Linux Release 26.7.3.
Overview
Introduction
Section 10 of RFC 4364 describes three potential methods for service providers to interconnect their IP-VPN (Internet Protocol — Virtual Private Network) backbones to provide an end-to-end MPLS-VPN where one or more sites of the VPN are connected to different service provider autonomous systems (ASs). The purpose of this chapter is to describe the configuration and troubleshooting for inter-AS VPN model C.
In this architecture, VPN prefixes are neither held, nor re-advertised by the Autonomous System Border Router — Provider Edge (ASBR-PE) routers, which makes Model C more scalable than Model B (where the only prefixes exchanged between ASs are VPN-IPv4). In Model C, the only MPLS data plane resources consumed in the ASBRs are for infrastructure addresses of PEs and RRs instead of VPN prefixes.
In this example, an export policy is configured to ensure that the nodes advertise their system IP addresses (IPv4 /32 addresses) in labeled BGP to all their BGP peers within the AS. Therefore, the ASBR-PE maintains labeled IPv4 /32 BGP routes to other PE routers within its own AS. These BGP routes are inactive, because for each destination within the AS, an IGP route exists which is preferred to BGP routes. The ASBR redistributes these inactive /32 IPv4 prefixes in external Border Gateway Protocol (EBGP) to the ASBR-PE in other service providers ASs, because advertise-inactive is configured in EBGP.
At the same time, the ASBR programs a label switch for the received and advertised BGP labels. The receiving ASBR advertises the received IP system prefixes to its IBGP peers (in this case, a Route Reflector (RR)) within their AS, and eventually, all PEs in the AS learn the system IP prefixes of the peer AS. However, there is no need to learn the system IP address of the ASBRs in peer ASs, because they do not exchange customer VPN prefixes.
After the system IP addresses have been learned in the peer AS, it is possible for PE routers in different ASs to establish multi-hop Multi Protocol — External Border Gateway Protocol (MP-EBGP) sessions for address family VPN-IPv4 to each other to exchange customer VPN prefixes over those connections. The multihop sessions can be established between the RR in the ASs, but these RRs should not modify the next-hop attribute of the BGP update across the EBGP session.
A three-level label stack is imposed on the ingress PE. The bottom-level label is assigned by the egress PE (advertised in multi-hop MP-EBGP without next-hop override) and is commonly referred to as the VPN-label. The middle label is assigned by the local ASBR-PE and corresponds to the /32 route of the egress PE (in a different AS) using BGP-LBL (RFC 3107). The top level label is the label assigned by the local ASBR-PE /32 loopback address, which is assigned by the IGP next-hop of the ingress PE. This label is referred to as the LDP-LBL.
Inter-AS VPN Model C illustrates this mechanism. The VPN-LBL is assigned by PE-5, the BGP-LBL is assigned by PE-4 and the LDP-LBL is also assigned by PE-4. The BGP-LBL is swapped in both ASBRs. The label stack contains three labels in each AS: VPN-LBL, BGP-LBL, and LDP-LBL) and two labels on the EBGP link between the ASs: VPN-LBL and BGP-LBL.
This configuration that uses advertise-inactive is preferred to a configuration where the BGP routes are not exchanged within their AS and the ASBRs use an export policy with a prefix list for all local system prefixes to be advertised to the peer ASs. The routes for those prefixes are taken from the RTM, where these routes are not known via BGP, but via IS-IS. In that case, IS-IS routes are effectively redistributed into labeled BGP (which most operators do not want) and as a result, the ASBR is not programming a label switch for the BGP label. Furthermore, the label stack is asymmetrical: three labels in the originating AS (VPN-LBL, BGP-LBL, and LDP-LBL) and only two labels in the target AS (VPN-LBL, LDP-LBL), because the local routes are not known via labeled BGP in this scenario. This scenario is not described in this chapter; only the preferred scenario with local labeled BGP routes in each AS is described.
The VPN connectivity is established using Labeled VPN route exchange using MP-EBGP without next-hop override. The PE connectivity is established as follows.
EBGP PE /32 loopback leaking routing exchange using EBGP LBL (RFC 3107) at the ASBR-PE. The /32 PE routes learned from the other AS through the ASBR-PE are further distributed into the local AS using IBGP and optionally through Route Reflectors (RRs). This model uses a three label stack and is referred to as Model C. Resilience for ASBR-PE failures depends on BGP.
Protocol overview shows the protocols used when implementing Inter-AS Model C. Inside each AS, there is an IS-IS adjacency and a link LDP session between each pair of adjacent nodes. As an alternative, OSPF can be used as IGP. There is an IBGP session between each PE and the RR. The address family is both VPN-IPv4 for the exchange of customer VPN prefixes and Labeled IPv4 for the exchange of labeled IPv4 prefixes. Between the RR and the ASBR, only Labeled IPv4 is required, because the ASBR does not exchange any customer VPN prefixes. When no RR is used, a full mesh of IBGP sessions can be established in each AS.
Between the ASBRs, there is an EBGP session for the exchange of labeled IPv4 prefixes. The ASBRs override the next-hop for those prefixes. Between the RRs in the different ASs, there is a multihop EBGP session for the exchange of VPN-IPv4 customer prefixes. The RRs do not override the next-hop for those prefixes.
The main advantage of this model is that no VPN routes need to be held on the ASBR-PEs and therefore, it scales the best among all the three Inter-AS IP-VPN models. However, leaking /32 PE addresses between service providers raises some security concerns. Therefore, we see Model C typically deployed within a service provider network.
Inter-AS VPN Model C shows the example topology which consists of four SR Linux nodes in AS 64496 and four SR Linux nodes in AS 64497. There is an AS interconnection between ASBR PE-4 to ASBR PE-8. PE-3 and PE-7 act as RRs for their AS. An IP-VPN is configured in each AS. The initial configuration includes the following:
-
IS-IS (or OSPF) on all interfaces within each of the ASs.
-
LDP on all interfaces within each of the ASs.
-
MP-IBGP sessions between the PE routers and the RRs in each of the ASs, as shown in the following section.
-
IP-VPN VRF1 with a loopback interface on PE-1 and on PE-5.
Configuration
The first step is to configure an MP-IBGP session between the PEs in both ASs. An export policy is configured to export the system prefixes from the PEs in labeled BGP.
PE-3 and PE-7 act as RR in the ASs. In AS 64496, PE-1 and PE-2 are peered with RR PE-3 for the labeled IPv4 and VPN-IPv4 address families; ASBR PE-4 is peered with RR PE-3 for the labeled IPv4 address family only. In AS 64497, PE-5 and PE-6 are peered with RR PE-7 for the labeled IPv4 and VPN-IPv4 address families; ASBR PE-8 is peered with RR PE-7 for the labeled IPv4 address family only.
Address family ipv4-labeled-unicast is required to advertise labeled IPv4 routes toward each neighbor PE. Address family l3vpn-ipv4-unicast is required to advertise IPv4 customer VPN routes within the AS.
The initial BGP configuration for RR PE-3 is as follows. The configuration for RR PE-7 is similar. The IP addresses can be derived from Inter-AS VPN Model C.
# on RR PE-3:
enter candidate
system {
mpls {
label-ranges {
dynamic dlb-bgp-lu {
start-label 30000
end-label 34999
}
}
}
}
network-instance default {
protocols {
bgp {
admin-state enable
autonomous-system 64496 # on RR PE-7: 64497
router-id 192.0.2.3 # on RR PE-7: 192.0.2.7
best-path-selection {
advertise-inactive true
}
bgp-label {
labeled-unicast {
dynamic-label-block dlb-bgp-lu
}
}
afi-safi ipv4-labeled-unicast {
admin-state enable
ipv4-labeled-unicast {
next-hop-resolution {
ipv4-next-hops {
tunnel-resolution {
allowed-tunnel-types [
ldp
]
}
}
}
}
}
group grp-IBGP {
admin-state enable
peer-as 64496 # on RR PE-7: 64497
export-policy [
rp-export-64496 # on RR PE-7: rp-export-64497
]
route-reflector {
cluster-id 192.0.2.3 # on RR PE-7: 192.0.2.7
client true
}
}
neighbor 192.0.2.1 { # on RR PE-7: 192.0.2.5
peer-group grp-IBGP
afi-safi l3vpn-ipv4-unicast {
admin-state enable
}
}
neighbor 192.0.2.2 { # on RR PE-7: 192.0.2.6
peer-group grp-IBGP
afi-safi l3vpn-ipv4-unicast {
admin-state enable
}
}
neighbor 192.0.2.4 { # on RR PE-7: 192.0.2.8
peer-group grp-IBGP
}
}The export policy exports the system IP address and is defined as follows:
# on PE-1, PE-2, PE-3:
enter candidate
routing-policy {
community-set cs-64496-0 { # on PE-5, PE-6, PE-7: cs-64497-0
member [
64496:0 # on PE-5, PE-6, PE-7: 64497:0
]
}
prefix-set ps-pe-sys {
prefix 192.0.2.0/28 mask-length-range 32..32 {
}
}
policy rp-export-64496 { # on PE-5, PE-6, PE-7: rp-export-64497
statement export-sys-with-comm-64496-0 { # on PE-5, PE-6, PE-7: ..-64497-0
match {
protocol local
prefix {
prefix-set ps-pe-sys
}
}
action {
policy-result accept
bgp {
communities {
add cs-64496-0 # on PE-5, PE-6, PE-7: cs-64497-0
}
}
}
}
}
}
On the ASBRs in both ASs, EBGP and IBGP need to be configured. The EBGP session is configured with advertise-inactive and is used to redistribute labeled IPv4 routes for the /32 system IP addresses between the ASs, even if those routes are not the most preferred routes within the system for a specific destination.
The configuration for ASBR PE-4 is as follows. The address family label-ipv4 is required to enable the advertising of labeled IPv4 routes. This address family is also required on the RR neighbor to propagate the labeled IPv4 routes toward the other PEs in the AS.
# on ASBR PE-4:
enter candidate
system {
mpls {
label-ranges {
dynamic dlb-bgp-lu {
start-label 30000
end-label 34999
}
}
}
}
routing-policy {
community-set cs-64496-0 {
member [
64496:0
]
}
community-set cs-64497-0 {
member [
64497:0
]
}
policy rp-export-64496 { # on ASBR PE-8: rp-import-64496
statement export-sys-with-comm-64496-0 { # on ASBR PE-8: import-sys-...
match {
bgp {
community-set cs-64496-0
}
}
action {
policy-result accept
}
}
}
policy rp-import-64497 { # on ASBR PE-8: rp-export-64497
statement import-sys-with-comm-64497-0 { # on ASBR PE-8: export-sys-...
match {
bgp {
community-set cs-64497-0
}
}
action {
policy-result accept
}
}
}
}
network-instance default {
protocols {
bgp {
admin-state enable
autonomous-system 64496 # on ASBR PE-8: 64497
router-id 192.0.2.4 # on ASBR PE-8: 192.0.2.8
best-path-selection {
advertise-inactive true
}
bgp-label {
labeled-unicast {
dynamic-label-block dlb-bgp-lu
}
}
afi-safi ipv4-labeled-unicast {
admin-state enable
ipv4-labeled-unicast {
next-hop-resolution {
ipv4-next-hops {
tunnel-resolution {
allowed-tunnel-types [
ldp
]
}
}
}
}
}
group grp-EBGP {
admin-state enable
peer-as 64497 # on ASBR PE-8: 64496
export-policy [
rp-export-64496 # on ASBR PE-8: rp-export-64497
]
import-policy [
rp-import-64497 # on ASBR PE-8: rp-import-64496
]
}
group grp-IBGP {
admin-state enable
peer-as 64496 # on ASBR PE-8: 64497
}
neighbor 192.0.2.3 { # on ASBR PE-8: 192.0.2.7
peer-group grp-IBGP
}
neighbor 192.168.48.2 { # on ASBR PE-8: 192.168.48.1
peer-group grp-EBGP
}
}
On the remaining PE nodes in AS 64496, PE-1 and PE-2, the address families ipv4-labeled-unicast and l3vpn-ipv4-unicast must be enabled, as follows:
# on PE-1, PE-2:
enter candidate
network-instance default {
protocols {
bgp {
admin-state enable
autonomous-system 64496 # on PE-5, PE-6: 64497
router-id 192.0.2.1 # on PE-2/5/6: 192.0.2.2/5/6
bgp-label {
labeled-unicast {
dynamic-label-block dlb-bgp-lu
}
}
afi-safi ipv4-labeled-unicast {
admin-state enable
ipv4-labeled-unicast {
next-hop-resolution {
ipv4-next-hops {
tunnel-resolution {
allowed-tunnel-types [
ldp
]
}
}
}
}
}
group grp-IBGP {
admin-state enable
peer-as 64496 # on PE-5, PE-6: 64497
export-policy [
rp-export-64496 # on PE-5, PE-6: rp-export-64497
]
}
neighbor 192.0.2.3 { # on PE-5, PE-6: 192.0.2.7
peer-group grp-IBGP
afi-safi l3vpn-ipv4-unicast {
admin-state enable
}
}
}The configuration for the nodes in AS 64497 is similar. The IP addresses can be derived from Inter-AS VPN Model C.
The following command on ASBR PE-4 verifies that the EBGP and IBGP sessions for the labeled IPv4 address family are established:
--{ + running }--[ ]--
A:admin@PE-4# show / network-instance default protocols bgp neighbor
------------------------------------------------------------------------------------------------------------------------------------------
BGP neighbor summary for network-instance "default"
Peer flags: see legend after the summary when applicable.
------------------------------------------------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------------------------------------------------
+---------------+-------------------+--------------+-------+----------+----------------+----------------+--------------------------------+
| Net-Inst | Peer | Group | Flags | Peer-AS | State | Uptime | AFI/SAFI [Rx/Active/Tx] |
+===============+===================+==============+=======+==========+================+================+================================+
| default | 192.0.2.3 | grp-IBGP | S | 64496 | established | 0d:0h:2m:49s | ipv4-labeled-unicast [3/0/3] |
| default | 192.168.48.2 | grp-EBGP | S | 64497 | established | 0d:0h:1m:48s | ipv4-labeled-unicast [3/3/3] |
+---------------+-------------------+--------------+-------+----------+----------------+----------------+--------------------------------+
------------------------------------------------------------------------------------------------------------------------------------------
Summary:
2 configured neighbors, 2 configured sessions are established, 0 disabled peers
0 dynamic peers
------------------------------------------------------------------------------------------------------------------------------------------
Peer flag legend:
S Static neighbor
On ASBR PE-4, three inactive labeled IPv4 routes have been received from the IBGP peers and three active labeled IPv4 routes have been received via EBGP, as follows:
--{ + running }--[ ]--
A:admin@PE-4#
show / network-instance default protocols bgp routes ipv4-labeled-unicast summary | grep -v 0.0.0.0 | grep -v 192.168.24.1 | grep -v 192.168.34.1
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP route table of network-instance "default"
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Status codes: u=used, *=valid, >=best, x=stale, b=backup, w=unused-weight-only
Origin codes: i=IGP, e=EGP, ?=incomplete
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+---------+------------------------------------------+------------------------------------------+---------+---------+-----------------------------------------------------------+
| Status | Network | Next Hop | MED | LocPref | Path Val |
+=========+==========================================+==========================================+=========+=========+===========================================================+
| * | 192.0.2.1/32 | 192.0.2.1 | | 100 | i |
| * | 192.0.2.2/32 | 192.0.2.2 | | 100 | i |
| * | 192.0.2.3/32 | 192.0.2.3 | | 100 | i |
| u*> | 192.0.2.5/32 | 192.168.48.2 | | | i[64497] |
| u*> | 192.0.2.6/32 | 192.168.48.2 | | | i[64497] |
| u*> | 192.0.2.7/32 | 192.168.48.2 | | | i[64497] |
+---------+------------------------------------------+------------------------------------------+---------+---------+-----------------------------------------------------------+
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
15 received BGP routes: 12 used, 15 valid, 0 stale
12 available destinations: 3 with ECMP multipaths
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
In this example, the IP prefixes for the ASBRs need not be advertised in labeled BGP to the remote AS, because ASBRs do not advertise VPN-IPv4 prefixes.
More detailed information about the route for prefix 192.0.2.5/32 received from neighbor 192.18.48.2 can be seen with following command on PE-4:
--{ + running }--[ ]--
A:admin@PE-4# show / network-instance default protocols bgp routes ipv4-labeled-unicast prefix 192.0.2.5/32 detail
------------------------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "192.0.2.5/32" network-instance "default"
------------------------------------------------------------------------------------------------------------------
Network: 192.0.2.5/32
Received Paths: 1
Path 1: <Best,Valid,Used,>
Route source : neighbor 192.168.48.2
Route Preference : MED is -, No LocalPref
BGP next-hop : 192.168.48.2
Path : i [64497]
Received Label : [30003]
Communities : 64497:0
RR Attributes : No Originator-ID, Cluster-List is [ - ]
Aggregation : Not an aggregate route
Unknown Attr : None
Invalid Reason : None
Tie Break Reason : none
Route Flap Damping: None
Path 1 was advertised to:
[ 192.0.2.3 ]
Route Preference: MED is -, LocalPref is 100
Path : i [64497]
Communities : 64497:0
RR Attributes : No Originator-ID, Cluster-List is [ - ]
Aggregation : Not an aggregate route
Unknown Attr : None
------------------------------------------------------------------------------------------------------------------
In the preceding output, the BGP label for prefix 192.0.2.5/32 that is received from PE-8 is 30003. PE-4 advertises this route to neighbor RR 192.0.2.3. PE-1 receives the following route for prefix 192.0.2.5/32 from neighbor PE-3. The BGP label 30004 is advertised by BGP next-hop ASBR PE-4. RR PE-3 keeps the BGP label unchanged.
--{ + running }--[ ]--
A:admin@PE-1# show network-instance default protocols bgp routes ipv4-labeled-unicast prefix 192.0.2.5/32 detail
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "192.0.2.5/32" network-instance "default"
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Network: 192.0.2.5/32
Received Paths: 1
Path 1: <Best,Valid,Used,>
Route source : neighbor 192.0.2.3
Route Preference : MED is -, LocalPref is 100
BGP next-hop : 192.0.2.4
Path : i [64497]
Received Label : [30004]
Communities : 64497:0
RR Attributes : Originator-ID 192.0.2.4, Cluster-List is [ 192.0.2.3 ]
Aggregation : Not an aggregate route
Unknown Attr : None
Invalid Reason : None
Tie Break Reason : none
Route Flap Damping: None
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
ASBR PE-4 swaps BGP labels toward ASBR PE-8 according to the following label mapping. When PE-4 receives traffic using the BGP tunnel from PE-1 toward PE-5 with BGP label 30004, ASBR PE-4 swaps it to BGP label 30003 toward ASBR PE-8:
--{ + running }--[ ]--
A:admin@PE-4# show network-instance default route-table mpls
+---------+-----------+-------------+-----------------+------------------------+----------------------+------------------+
| Label | Operation | Type | Next Net-Inst | Next-hop IP (Type) | Next-hop | Next-hop MPLS |
| | | | | | Subinterface | labels |
+=========+===========+=============+=================+========================+======================+==================+
| 20000 | POP | ldp | default | | | |
| 20001 | SWAP | ldp | N/A | 192.168.24.1 (mpls) | ethernet-1/2.0 | 20001 |
| 20002 | SWAP | ldp | N/A | 192.168.24.1 (mpls) | ethernet-1/2.0 | 20000 |
| 20003 | SWAP | ldp | N/A | 192.168.34.1 (mpls) | ethernet-1/3.0 | 20000 |
| 30000 | POP | bgp | default | | | |
| 30001 | SWAP | bgp | N/A | | | 30000 |
| 30002 | SWAP | bgp | N/A | | | 30000 |
| 30003 | SWAP | bgp | N/A | | | 30000 |
| 30004 | SWAP | bgp | N/A | 192.168.48.2 (mpls) | ethernet-1/8.0 | 30003 |
| 30005 | SWAP | bgp | N/A | 192.168.48.2 (mpls) | ethernet-1/8.0 | 30002 |
| 30006 | SWAP | bgp | N/A | 192.168.48.2 (mpls) | ethernet-1/8.0 | 30001 |
+---------+-----------+-------------+-----------------+------------------------+----------------------+------------------+
ASBR PE-8 swaps BGP label 30003 to BGP label 30000 toward PE-5, as follows:
--{ + running }--[ ]--
A:admin@PE-8# show network-instance default route-table mpls
+---------+-----------+-------------+-----------------+------------------------+----------------------+------------------+
| Label | Operation | Type | Next Net-Inst | Next-hop IP (Type) | Next-hop | Next-hop MPLS |
| | | | | | Subinterface | labels |
+=========+===========+=============+=================+========================+======================+==================+
| 20000 | POP | ldp | default | | | |
| 20001 | SWAP | ldp | N/A | 192.168.68.1 (mpls) | ethernet-1/6.0 | 20001 |
| 20002 | SWAP | ldp | N/A | 192.168.68.1 (mpls) | ethernet-1/6.0 | 20000 |
| 20003 | SWAP | ldp | N/A | 192.168.78.1 (mpls) | ethernet-1/7.0 | 20000 |
| 30000 | POP | bgp | default | | | |
| 30001 | SWAP | bgp | N/A | | | 30000 |
| 30002 | SWAP | bgp | N/A | | | 30000 |
| 30003 | SWAP | bgp | N/A | | | 30000 |
| 30004 | SWAP | bgp | N/A | 192.168.48.1 (mpls) | ethernet-1/4.0 | 30003 |
| 30005 | SWAP | bgp | N/A | 192.168.48.1 (mpls) | ethernet-1/4.0 | 30002 |
| 30006 | SWAP | bgp | N/A | 192.168.48.1 (mpls) | ethernet-1/4.0 | 30001 |
+---------+-----------+-------------+-----------------+------------------------+----------------------+------------------+
On PE-5, BGP label 30000 is popped:
--{ + running }--[ ]--
A:admin@PE-5# # Step 22d - Show labeled IPv4 BGP routes (6 routes) - on PE-4 (or all)
show network-instance default route-table mpls
+---------+-----------+-------------+-----------------+------------------------+----------------------+------------------+
| Label | Operation | Type | Next Net-Inst | Next-hop IP (Type) | Next-hop | Next-hop MPLS |
| | | | | | Subinterface | labels |
+=========+===========+=============+=================+========================+======================+==================+
| 20000 | POP | ldp | default | | | |
| 20001 | SWAP | ldp | N/A | 192.168.56.2 (mpls) | ethernet-1/6.0 | 20000 |
| 20002 | SWAP | ldp | N/A | 192.168.57.2 (mpls) | ethernet-1/7.0 | 20000 |
| 20003 | SWAP | ldp | N/A | 192.168.56.2 (mpls) | ethernet-1/6.0 | 20003 |
| 30000 | POP | bgp | default | | | |
| 40000 | | network- | VRF1 | | | |
| | | instance | | | | |
+---------+-----------+-------------+-----------------+------------------------+----------------------+------------------+
On ASBR PE-4, the routes toward PE-5, PE-6, and PE-7 in the remote AS have been installed in the route table, as follows:
--{ + running }--[ ]--
A:admin@PE-4# show network-instance default ipv4 route
====================================================================================================================================
IPv4-unicast route table for default network-instance
------------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
------------------------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
------------------------------------------------------------------------------------------------------------------------------------
192.0.2.1/32 isis 20 18 > 192.168.24.1(ethernet-1/2.0)
192.0.2.2/32 isis 10 18 > 192.168.24.1(ethernet-1/2.0)
192.0.2.3/32 isis 10 18 > 192.168.34.1(ethernet-1/3.0)
192.0.2.5/32 bgp-label 0 170 > mpls(192.168.48.2, ethernet-1/8.0, label:30003)
192.0.2.6/32 bgp-label 0 170 > mpls(192.168.48.2, ethernet-1/8.0, label:30001)
192.0.2.7/32 bgp-label 0 170 > mpls(192.168.48.2, ethernet-1/8.0, label:30002)
192.168.12.0/30 isis 20 18 > 192.168.24.1(ethernet-1/2.0)
192.168.13.0/30 isis 20 18 > 192.168.34.1(ethernet-1/3.0)
192.168.24.0/30 local 0 0 > 192.168.24.2(ethernet-1/2.0)
192.168.34.0/30 local 0 0 > 192.168.34.2(ethernet-1/3.0)
192.168.48.0/30 local 0 0 > 192.168.48.1(ethernet-1/8.0)
The BGP labeled routes for the remote PE system prefixes are further advertised toward all the PEs in the AS (through the RR) and are installed in the routing table on all PEs.
At this point, all PEs in one AS have the /32 system IPs of the remote PEs in their routing table, for example for PE-1:
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance default ipv4 route
====================================================================================================================================
IPv4-unicast route table for default network-instance
------------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
------------------------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
------------------------------------------------------------------------------------------------------------------------------------
192.0.2.2/32 isis 10 18 > 192.168.12.2(ethernet-1/2.0)
192.0.2.3/32 isis 10 18 > 192.168.13.2(ethernet-1/3.0)
192.0.2.4/32 isis 20 18 > 192.168.12.2(ethernet-1/2.0)
192.0.2.5/32 bgp-label 20 170 > mpls(192.0.2.4/32, ldp:65539, label:30004)
192.0.2.6/32 bgp-label 20 170 > mpls(192.0.2.4/32, ldp:65539, label:30006)
192.0.2.7/32 bgp-label 20 170 > mpls(192.0.2.4/32, ldp:65539, label:30005)
192.168.12.0/30 local 0 0 > 192.168.12.1(ethernet-1/2.0)
192.168.13.0/30 local 0 0 > 192.168.13.1(ethernet-1/3.0)
192.168.24.0/30 isis 20 18 > 192.168.12.2(ethernet-1/2.0)
192.168.34.0/30 isis 20 18 > 192.168.13.2(ethernet-1/3.0)
All PEs in one AS have also received labels for all /32 system IP addresses of the remote PEs. Therefore, an MP-EBGP session can be created between the RRs in the different ASs to exchange VPN-IPv4 routes.
The following configures an EBGP multihop session between the RR in the different ASs. The additional configuration on RR PE-3 is as follows. The configuration for RR PE-7 is similar. The IP addresses can be derived from Protocol overview.
# on RR PE-3:
enter candidate
routing-policy {
extended-community-set ecs-vrf1-64496 {
member [
target:64496:1
]
}
extended-community-set ecs-vrf1-64497 {
member [
target:64497:1
]
}
policy rp-export-ebgp-vpn {
default-action {
policy-result reject
}
statement export-target:64496:1 { # on RR PE-7: export-target:64497:1
match {
bgp {
extended-community {
extended-community-set ecs-vrf1-64496 # on RR PE-7: ecs-vrf1-64497
}
}
}
action {
policy-result accept
}
}
}
policy rp-import-ebgp-vpn {
default-action {
policy-result reject
}
statement import-target:64497:1 { # on RR PE-7: import-target:64496:1
match {
bgp {
extended-community {
extended-community-set ecs-vrf1-64497 # on RR PE-7: ecs-vrf1-64496
}
}
}
action {
policy-result accept
}
}
}
}
network-instance default {
protocols {
bgp {
group grp-EBGP-multihop {
peer-as 64497 # on RR PE-7: 64496
transport {
local-address 192.0.2.3 # on RR PE-7: 192.0.2.7
}
multihop {
admin-state enable
maximum-hops 10
}
afi-safi l3vpn-ipv4-unicast {
admin-state enable
export-policy [
rp-export-ebgp-vpn
]
import-policy [
rp-import-ebgp-vpn
]
}
afi-safi ipv4-labeled-unicast {
admin-state disable # do not inherit from global BGP context
}
}
neighbor 192.0.2.7 { # on RR PE-7: 192.0.2.3
peer-group grp-EBGP-multihop
}
}
The following shows that the EBGP multihop session between the RRs is established, as follows:
--{ + running }--[ ]--
A:admin@PE-3# show / network-instance default protocols bgp neighbor 192.0.2.7
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
BGP neighbor summary for network-instance "default"
Peer flags: see legend after the summary when applicable.
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+-----------------------+-------------------+-----------------------+--------+------------+-------------------+-------------------+-------------------------------------------------+
| Net-Inst | Peer | Group | Flags | Peer-AS | State | Uptime | AFI/SAFI [Rx/Active/Tx] |
+=======================+===================+=======================+========+============+===================+===================+=================================================+
| default | 192.0.2.7 | grp-EBGP-multihop | S | 64497 | established | 0d:0h:0m:25s | l3vpn-ipv4-unicast [1/0/1] |
+-----------------------+-------------------+-----------------------+--------+------------+-------------------+-------------------+-------------------------------------------------+
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Summary:
4 configured neighbors, 4 configured sessions are established, 0 disabled peers
0 dynamic peers
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Peer flag legend:
S Static neighborThe IP-VRFs on PE-1 in AS 64496 and PE-5 in AS 64497 are now interconnected. The route table for VRF1 shows that the remote PE can be reached via a BGP tunnel, as follows:
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance VRF1 ipv4 route
=========================================================================================================================================================================================================================
IPv4-unicast route table for ip-vrf network-instance: VRF1
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Flags: > (best), * (unviable), ! (failed)
: L (leaked route from another network-instance)
: B (backup NHG active and displayed)
: S (statistics supported)
: D (dynamic LB), R (resilient LB)
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Prefix Route Type Metric Pref Flags Next-Hop(s)
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.5.5.5/32 bgp-ipvpn 1000 170 > 192.0.2.5(tunnel:bgp, label:40000)
The following ping from VRF1 on PE-1 is originated toward the loopback IP address in VRF1 on PE-5:
--{ + running }--[ ]--
A:admin@PE-1# ping network-instance VRF1 10.5.5.5 -c 2
Using network instance VRF1
PING 10.5.5.5 (10.5.5.5) 56(84) bytes of data.
64 bytes from 10.5.5.5: icmp_seq=1 ttl=64 time=6.39 ms
64 bytes from 10.5.5.5: icmp_seq=2 ttl=64 time=4.95 ms
--- 10.5.5.5 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 4.949/5.670/6.392/0.721 ms
Packets originating in AS 64496 with a destination in AS 64497 have three labels in AS 64496 (and in AS 64497). The top label is the LDP label to reach the exit point of the AS (ASBR PE-4). This label has value 20003, as can be seen with following command on PE-1:
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance default route-table mpls
+---------+-----------+-------------+-----------------+------------------------+----------------------+------------------+
| Label | Operation | Type | Next Net-Inst | Next-hop IP (Type) | Next-hop | Next-hop MPLS |
| | | | | | Subinterface | labels |
+=========+===========+=============+=================+========================+======================+==================+
| 20000 | POP | ldp | default | | | |
| 20001 | SWAP | ldp | N/A | 192.168.12.2 (mpls) | ethernet-1/2.0 | 20000 |
| 20002 | SWAP | ldp | N/A | 192.168.13.2 (mpls) | ethernet-1/3.0 | 20000 |
| 20003 | SWAP | ldp | N/A | 192.168.12.2 (mpls) | ethernet-1/2.0 | 20003 |
| 30000 | POP | bgp | default | | | |
| 40000 | | network- | VRF1 | | | |
| | | instance | | | | |
+---------+-----------+-------------+-----------------+------------------------+----------------------+------------------+
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance default protocols ldp ipv4 fec
=========================================================================================================================================================================================================================
Net-Inst default LDP IPv4: All FEC prefixes table
=========================================================================================================================================================================================================================
Received FEC prefixes
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+--------------------------------------------------------------------------------------------+
| FEC prefix Peer LDP ID Label Ingress Used in |
| LSR Forwarding |
+============================================================================================+
| 192.0.2.2/32 192.0.2.2:0 20000 true true |
| 192.0.2.2/32 192.0.2.3:0 20002 true false |
| 192.0.2.3/32 192.0.2.2:0 20002 true false |
| 192.0.2.3/32 192.0.2.3:0 20000 true true |
| 192.0.2.4/32 192.0.2.2:0 20003 true true |
| 192.0.2.4/32 192.0.2.3:0 20003 true false |
+--------------------------------------------------------------------------------------------+
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Advertised FEC prefixes
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+--------------------------------------------------------------------------------------------+
| FEC prefix Peer LDP ID Label Label Egress |
| Status LSR |
+============================================================================================+
| 192.0.2.1/32 192.0.2.2:0 20000 true |
| 192.0.2.1/32 192.0.2.3:0 20000 true |
| 192.0.2.2/32 192.0.2.3:0 20001 false |
| 192.0.2.3/32 192.0.2.2:0 20002 false |
| 192.0.2.4/32 192.0.2.2:0 20003 false |
| 192.0.2.4/32 192.0.2.3:0 20003 false |
+--------------------------------------------------------------------------------------------+
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total received FEC prefixes : 6 (3 used in forwarding)
Total advertised FEC prefixes: 6
=========================================================================================================================================================================================================================
This LDP label is popped by ASBR PE-4. No LDP label is used between the ASBRs. ASBR PE-8 pushes another LDP label.
To reach a PE in the remote AS, a BGP transport label is required, which is the middle label in the stack. The tunnel table on PE-1 shows a BGP tunnel toward PE-5, as follows:
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance default tunnel-table ipv4
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
IPv4 tunnel table of network-instance "default"
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+----------------------------------------+----------------+----------+-----+----------+---------+--------------------------+------------------------+------------------------+------------------------------------------+
| IPv4 Prefix | Tunnel Type | Tunnel | FIB | Metric | Prefere | Last Update | Backup Nexthops | Next-hop (Type) | Next-hop |
| | | ID | | | nce | | | | |
+========================================+================+==========+=====+==========+=========+==========================+========================+========================+==========================================+
| 192.0.2.2/32 | ldp | 65537 | Y | 10 | 9 | 2026-10-08T12:38:19.696Z | | 192.168.12.2 (mpls) | ethernet-1/2.0 |
| 192.0.2.3/32 | ldp | 65538 | Y | 10 | 9 | 2026-10-08T12:38:32.403Z | | 192.168.13.2 (mpls) | ethernet-1/3.0 |
| 192.0.2.4/32 | ldp | 65539 | Y | 20 | 9 | 2026-10-08T12:38:46.461Z | | 192.168.12.2 (mpls) | ethernet-1/2.0 |
| 192.0.2.5/32 | bgp | 262145 | Y | 1000 | 12 | 2026-10-08T12:41:39.194Z | | 192.0.2.4/32 (ldp) | ethernet-1/2.0 |
| 192.0.2.6/32 | bgp | 262147 | Y | 1000 | 12 | 2026-10-08T12:41:39.194Z | | 192.0.2.4/32 (ldp) | ethernet-1/2.0 |
| 192.0.2.7/32 | bgp | 262146 | Y | 1000 | 12 | 2026-10-08T12:41:39.194Z | | 192.0.2.4/32 (ldp) | ethernet-1/2.0 |
+----------------------------------------+----------------+----------+-----+----------+---------+--------------------------+------------------------+------------------------+------------------------------------------+
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
3 LDP tunnels, 3 active, 0 inactive
3 BGP tunnels, 3 active, 0 inactive
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
The BGP label 30004 is assigned and advertised by the next hop, in this case by the local ASBR PE-4, as follows:
--{ + running }--[ ]--
A:admin@PE-1# show / network-instance default protocols bgp routes ipv4-labeled-unicast prefix 192.0.2.5/32 detail
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Show report for the BGP routes to network "192.0.2.5/32" network-instance "default"
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Network: 192.0.2.5/32
Received Paths: 1
Path 1: <Best,Valid,Used,>
Route source : neighbor 192.0.2.3
Route Preference : MED is -, LocalPref is 100
BGP next-hop : 192.0.2.4
Path : i [64497]
Received Label : [30004]
Communities : 64497:0
RR Attributes : Originator-ID 192.0.2.4, Cluster-List is [ 192.0.2.3 ]
Aggregation : Not an aggregate route
Unknown Attr : None
Invalid Reason : None
Tie Break Reason : none
Route Flap Damping: None
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
This BGP label is swapped by ASBR PE-4 in AS 64496 and by ASBR PE-8 in AS 64497.
The bottom label is the VPN label assigned by the remote PE in the remote AS for the destination network. This VPN label is retrieved on PE-1, as follows:
-{ + running }--[ ]--
A:admin@PE-1# show / network-instance VRF1 ipv4 route 10.5.5.5/32 detail
=========================================================================================================================================================================================================================
Prefix: 10.5.5.5/32
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Active : yes
Route Type : bgp-ipvpn
Route Owner : bgp_ipvpn_mgr, 2026-10-08T13:05:51.542Z (4 minutes ago)
Id : 0
Leakable : no
Leaked : no
Metric : 1000
Preference : 170
Internal Tags : none
Dynamic LB : no
Resilient Hash : no
FIB Suppressed : no
FIB Failed : no
Next-Hop-Group : 2236204430
Net-Instance : VRF1
FIB Failed : no
Primary NH Count : 1
Backup NH Count : 0
Primary NH : 2236204430
LB Weight : 1
Type : indirect
IP Address : 192.0.2.5
Resolved : yes
Resolving Tunnel : 192.0.2.5/32(bgp, 262145)
MPLS Lbl Stack : 40000
Conclusion
Inter-AS VPN option C allows the delivery of Layer 3 VPN services to customers who have sites connected in different ASs. This example shows the configuration of inter-AS VPN option C (specific to this feature) together with the associated show output which can be used for verification and troubleshooting.