Inter-AS L3VPN Pt. 2, Option A
In this article we will cover Inter-AS L3VPN Option A.
SP1 and SP2 peer directly over a L3 NNI, as following. These are the ASBRs.
SP1 provides Customer A service at location A (CE1). SP2 provides Customer A service at location B (CE2).
We’ll setup Inter-AS Option A, in which SP1_R3 will treat SP2_XR1 as another CE. SP2_XR1 will also treat SP1_R3 as a CE.
Lab
Here are the sartup configs. SP1 runs OSPF and SP2 runs ISIS. R2 for each SP is a RR. Intra-AS L3VPN is setup, but CE1 cannot reach CE2 yet.
Notice that the PE of each SP is learning the customer’s route via the local CE, but the customer does not have end-to-end reachability yet.
Configuring the L3 NNI
We’ll now configure the ASBRs. This involves each router simulanteouly acting as a PE and CE. From its own perspective, it is a PE. From the other service provider’s perspective, it is a CE.
You’ll see that the drawback to Option A is that you must configure every VRF on the router where the L3 NNI is terminated, since the other end is treated as a CE in the VRF. We must import the routes learned from the CE into the vpnv4 unicast table.
Additionally, we must create a subinterface for every VRF, as we cannot “re-use” a single interface for multiple VRFs.
Note: You may run into a bug on the CSR1000v with sub interfaces. To work around it, you can try creating a service instance for encapsulation untagged under the physical interface:
CE1 now has reachability to CE2.
Try to write down the AS paths seen on CE1 for 10.1.2.0/24 and CE2 for 10.1.1.0/24, and then check your work on the devices.
Notice that each SP can use its own RT values for the vpnv4 routes. Each SP runs a completely separate VPN, and they share routes at the L3 NNI as if each other were CEs.
Traffic is unlabeled at the L3 NNI. It simply has a dot1q tag, no MPLS label.
Conclusion
Inter-AS Option A is the simplest solution for providing L3VPN service for a customer through an L3 NNI. From each service provider’s perspective, the other service provider is treated as a CE.
While easy and intuitive to configure, the drawback is lack of scalability. If there are 200 L3VPNs that need to span this L3 NNI, there are 200 subinterfaces, 200 VRFs, and 200 BGP peering sessions that need to be configured on each ASBR.
In Option B and C we will see solutions that allow for greater scale. However this will come at the cost of needing to share more information between SPs. Option A is the most secure because SPs do not have to share information such as RT values, etc.
Last updated