Configuring Nested Vpn - HP 10500 Series Configuration Manual

Assigns MPLS labels to routes received from the PEs in the local AS before advertising them to the
•
peer ASBR PE.
Assigns new MPLS labels to labeled IPv4 routes advertised to PEs in the local AS.
•
Which IPv4 routes are assigned with MPLS labels depends on the routing policy. Only routes that meet
the criteria are assigned with labels. All other routes are still common IPv4 routes.
To configure a routing policy for inter-AS option C on an ASBR PE:
Step
1. Enter system view.
2. Create a routing policy and
enter routing policy view.
3. Match IPv4 routes carrying
labels.
4. Set labels for IPv4 routes.

Configuring nested VPN

For a network with many VPNs, nested VPN is a good solution to implement layered management of
VPNs and to conceal the deployment of internal VPNs.
To build a nested VPN network, perform the following configurations:
Configurations between customer PE and customer CE—Configure VPN instances on the customer
•
PE and configure route exchange between customer PE and customer CE.
• Configurations between customer PE and provider CE—Configure BGP VPN4 route exchange
between them.
Configurations between provider CE and provider PE—Configure VPN instances and enable
•
nested VPN on the provider PE and configure BGP VPNv4 route exchange between the provider CE
and provider PE. To make sure the provider CE can receive all VPNv4 routes, configure the undo
policy vpn-target command on the provider CE to not filter VPNv4 routes by RTs.
Configurations between provider PEs—Configure BGP VPNv4 route exchange between them.
•
Nested VPN allows a customer PE to directly exchange VPNv4 routes with a provider PE, without
needing to deploy a provider CE. In this case, the customer PE also acts as the provider CE. Therefore,
you must configure provider CE settings on it.
Configurations on the customer CE, customer PE, and provider CE are similar to basic MPLS L3VPN
configurations. This task describes the configurations on the provider PE.
When you configure nested VPN, follow these guidelines:
• The address spaces of sub-VPNs of a VPN cannot overlap.
Do not assign nested VPN peers addresses that public network peers use.
•
Nested VPN does not support multi-hop EBGP. A provider PE and a provider CE must use the
•
addresses of the directly connected interfaces to establish a neighbor relationship.
To configure nested VPN:
Command
system-view
route-policy policy-name permit
node seq-number
if-match mpls-label
apply mpls-label
117
Remarks
N/A
By default, no routing policy is
created.
By default, no match criterion is
configured.
By default, no apply clause is
configured.