Cisco IOS XE: Настройка атрибута BGP-VPN Distinguisher (Руководство по настройке) (EN)

Role and Benefit of the VPN Distinguisher Attribute

Configuring BGP-VPN Distinguisher Attribute Information About BGP-VPN Distinguisher Attribute, on page 1 How to Configure BGP-VPN Distinguisher Attribute, on page 3 Configuration Example for Translating RT to VPN Distinguisher to RT, on page 8 Feature History for BGP-VPN Distinguisher Attribute, on page 9 Information About BGP-VPN Distinguisher Attribute The following sections provide information about BGP-VPN distinguisher attribute. Role and Benefit of the VPN Distinguisher Attribute Route-target (RT) extended community attributes identify the VPN membership of routes.

The RT attributes are placed onto a route at the exporting (egress) provider edge router (PE) and are transported across the iBGP cloud and across autonomous systems. Any Virtual Routing and Forwarding (VRF) instances at the remote PE that want to import such routes must have the corresponding RTs set as import RTs for that VRF. The figure below illustrates two autonomous systems, each containing customer edge routers (CEs) that belong to different VPNs. Each PE tracks which route distinguisher (RD) corresponds to which VPN, thus controlling the traffic that belongs to each VPN. Figure 1:

Scenario in Which ASBRs Translate RTs Between Autonomous Systems Configuring BGP-VPN Distinguisher Attribute 1

Стр. 1

How the VPN Distinguisher Attribute Works

In an Inter-AS Option B scenario like the one in the figure above, these routes are carried across an AS boundary from Autonomous System Border Router 1 (ASBR1) to ASBR2 over an MP-eBGP session, with the routes’ respective RTs as extended community attributes being received by ASBR2. ASBR2 must maintain complex RT mapping schemes to translate RTs originated by AS1 to RTs recognized by AS2, so that the RTs can be imported by their respective VPN membership CE connections on PE2 for CE3 and CE4. Some network administrators prefer to hide the RTs they source in AS1 from devices in AS2.

In order to do that, the administrator must differentiate routes belonging to each VPN with a certain attribute so that the RTs can be removed on the outbound side of ASBR1 before sending routes to ASBR2, and ASBR2 can then map that attribute to recognizable RTs in AS2. The VPN Distinguisher (VD) extended community attribute serves that purpose. The benefit of the BGP—VPN Distinguisher Attribute feature is that source RTs can be kept private from devices in destination autonomous systems.

How the VPN Distinguisher Attribute Works The network administrator configures the egress ASBR to perform translation of RTs to a VPN distinguisher extended community attribute, and configures the ingress ASBR to perform translation of the VPN distinguisher to RTs. More specifically, the translation is achieved as follows: On the Egress ASBR • An outbound route map specifies a match excommunity clause that determines which VPN routes are subject to mapping, based on the route’s RT values. set extcommunity vpn-distinguisher command sets the VPN distinguisher that replaces the RTs.

• The set extcomm-list delete command that references the same set of RTs is configured to remove the RTs, and then the route is sent to the neighboring ingress ASBR. On the Ingress ARBR • An inbound route map specifies a match excommunity vpn-distinguisher command that determines which VPN routes are subject to mapping, based on the route’s VPN distinguisher. • The set extcommunity rt command specifies the RTs that replace the VPN distinguisher. • For routes that match the clause, the VPN distinguisher is replaced with the configured RTs.

Additional Behaviors Related to the VPN Distinguisher On the egress ASBR, if a VPN route matches a route map clause that does not have the set extcommunity vpn-distinguisher command that is configured, the RTs that the VPN route is tagged with are retained. The VPN distinguisher is transitive across the AS boundary, but is not carried within the iBGP cloud. That is, the ingress ASBR can receive the VPN distinguisher from an eBGP peer, but the VPN distinguisher is discarded on the inbound side after it is mapped to the corresponding RTs.

On the ingress ASBR, if a VPN route carrying the VPN distinguisher matches a route map clause that does not have a set extcommunity rt command that is configured in the inbound route map, the system does not discard the attribute, nor does it propagate the attribute within the iBGP cloud. The VPN distinguisher for the route is retained so that the network administrator can configure the correct inbound policy to translate the VPN distinguisher to the RTs that the VPN route should carry. If the route is sent to eBGP peers, the VPN Configuring BGP-VPN Distinguisher Attribute How the VPN Distinguisher Attribute Works Configuring BGP-VPN Distinguisher Attribute 2

Стр. 2

Replacing an RT with a VPN Distinguisher Attribute

distinguisher is carried as is. The network administrator could configure a route-map entry to remove the VPN distinguisher from routes that are sent to eBGP peers. Configuring a set extcommunity vpn-distinguisher command in an outbound route map or a match excommunity command in an inbound route map results in an outbound or inbound route refresh request, respectively, in order to update the routes being sent or received. BGP-VPN Distinguisher Attribute The BGP—VPN Distinguisher Attribute feature allows a network administrator to keep source route targets (RTs) private from an Autonomous System Border Router (ASBR) in a destination autonomous system.

An RT at an egress ASBR is mapped to a VPN distinguisher, the VPN distinguisher is carried through the eBGP, and then it is mapped to an RT at the ingress ASBR. How to Configure BGP-VPN Distinguisher Attribute The following sections provide configuration information about BGP-VPN distinguisher attribute. Replacing an RT with a VPN Distinguisher Attribute Perform this task on an egress ASBR to replace a route target (RT) with a VPN distinguisher extended community attribute. Remember to replace the VPN distinguisher with a route target on the ingress ASBR; that task is described in the “Replacing a VPN Distinguisher Attribute with an RT” section.

Procedure Configuring BGP-VPN Distinguisher Attribute BGP-VPN Distinguisher Attribute Command or Action Purpose Step 1 enable Example: Device> enable Enables privileged EXEC mode. Enter your password if prompted. Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode. Step 3 ip extcommunity-list expanded-list {permit | deny} rt value Example: Device(config)# ip extcommunity-list 4 permit rt 101:100 Configures an IP extended community list to configure Virtual Private Network (VPN) route filtering, such that routes with the specified RT are in the extended community list. This example permits routes having RT 101:100 into the extended community list 4.

Step 4 exit Example: Exits the configuration mode and enters the next higher configuration mode. Configuring BGP-VPN Distinguisher Attribute 3

Стр. 3

Replacing an RT with a VPN Distinguisher Attribute

Configuring BGP-VPN Distinguisher Attribute Replacing an RT with a VPN Distinguisher Attribute Command or Action Purpose Device(config-extcomm-list)# exit Step 5 route-map map-tag {permit | deny} [sequence-number] Example: Device(config)# route-map vpn-id-map1 permit 10 Configures a route map that permits or denies the routes that are allowed by the subsequent match command. This example permits the routes that are allowed by the subsequent match command. Step 6 match extcommunity extended-community-list-name Example: Device(config-route-map)# match extcommunity 4 Matches on the specified community list.

For this example, routes that match the extended community list 4 (which was configured in Step 3) are subject to the subsequent set commands. Step 7 set extcomm-list extcommunity-name delete Example: Device(config-route-map)# set extcomm-list 4 delete Deletes the RT from routes that are in the specified extended community list. For this example, RTs are deleted from routes that are in extended community list 4. Step 8 set extcommunity vpn-distinguisher id Example: Device(config-route-map)# set extcommunity vpn-distinguisher 111:100 For the routes that are permitted by the route map, sets the specified VPN distinguisher.

For this example, routes that match extended community 4 have their VPN distinguisher set to 111:100. Step 9 exit Example: Device(config-route-map)# exit Exits route-map configuration mode and enters global configuration mode. Step 10 route-map map-name {permit | deny} [sequence-number] Example: Device(config)# route-map vpn-id-map1 permit 20 (Optional) Configures a route map entry that permits routes. This example configures a route map entry that permits other routes not subject to the RT-to-VPN distinguisher mapping. If you do not perform this step, all other routes are subject to an implicit deny. Step 11 exit Example:

Device(config-route-map)# exit Exits route-map configuration mode and enters global configuration mode. Configuring BGP-VPN Distinguisher Attribute 4

Стр. 4