Figure 19: Internet Ipvpn - Avaya 8600 Technical Configuration Manual

The only way for traffic to be routed between VRF spokes of different color is via the external firewalls.
Indeed, as this is not desired in this design, care should be taken to configure the firewalls so that any
traffic received from the interface connecting to Site1 (or Site2) is not to be routed back onto the same
interface (i.e. firewall routing as a stub).
FW1
Site1
MLT Hash
Site4
For the Internet IPVPN the Internet VRF has VRF-id = 255 and VPN-id = 000
In this case we shall be using the CLIP#3 address which is identical on both Site1 & Site2.
Hence the RD will be: 172.16.0.<256 - VRF-id>:<VRF-id> = 172.16.0.1:255
Whereas the RT will be set to <AS-number>:6<VPN-id><0 for Hub / 1 for Spoke>:
Internet Hub VRF export RT = 65000:60000 = Green/Red Spoke VRF import RT
Internet Hub VRF import RT = 65000:60001 = Green/Red Spoke VRF export RT
This will ensure that the spokes only learn the default route from the 2 hubs while the 2 hubs will learn all
the spoke routes.
Network Design Implementation to Provide L2 & L3 VPN Connectivity
November 2010
Internet
MLT Hash
DualHub&Spoke
IPVPN-Internet
IST MLT

Figure 19: Internet IPVPN

between Sites using SMLT and IPVPN-Lite for ERS 8600
Technical Configuration Guide
Site3
MLT Hash
Site5
avaya.com
FW2
Site2
78