[c-nsp] MPLS VPN with lot of PPP interfaces and central firewall (Half Duplex VRF / HDVRF)

Gerald Krause gk at ax.tc
Tue Feb 23 05:40:49 EST 2010

Am 23.02.2010 09:02, Oliver Boehmer (oboehmer) schrieb:
>> Am 19.02.2010 10:13, Gerald Krause schrieb:
>>> I hope the rest of my Half Duplex VRF will work now as this initial
>>> problem seems to be solved.
>> I'am still unable to separate the branches (LANs) on the LNS/PE. I
> would
>> expect, that any certain LAN1 from CPE1 isn't allowed to access a LAN2
>> behind a CPE2 directly through the LNS/PE but this isn't the case.
>> Maybe I have a wrong understanding how I should configure the two
>> Down/UP-VRFs correctly and/or how the export/import works in such a
>> case. Any suggestions would be appreciate.
> Interesting.. Your config looks ok. I don't have a lab setup ready, but
> can you inject a (bogus or valid) default from a remote PE into the
> "VRFTEST-UP" so you actually provide any routing for the branches?
> i.e.
> hostname hub-PE
> !
> ip vrf VRFTEST-HUB
>  rd x:y
>  route-target export 101:0
>  route-target import 102:2
> !
> int lo123
>  ip vrf forwarding VRFTEST-HUB
>  ip address
> !
> router bgp ..
>  address-family ipv4 vrf VRFTEST-HUB
>   default-information originate
>   redistribute static
>   redistribute connected
> !
> ip route vrf Null0

Hello Oli, thx for your support again. I have configured the HUB/PE as

interface Loopback102
 ip vrf forwarding VRFTEST-HUB
 ip address
ip route vrf VRFTEST-HUB Null0

The export/import looks good:

LNS#sh ip route vrf VRFTEST-DOWN is variably subnetted, 4 subnets, 2 masks
U [1/0] via
U [1/0] via
C is directly connected, Virtual-Access2.123
C is directly connected, Virtual-Access2.121

LNS#sh ip route vrf VRFTEST-UP
B* [200/0] via x.x.x.x 00:10:25 is subnetted, 2 subnets
B [200/0] via x.x.x.x, 00:10:25
C is directly connected, Loopback102

HUB#sh ip route vrf VRFTEST-HUB
S* is directly connected, Null0 is variably subnetted, 3 subnets, 2 masks
B [200/0] via, 00:13:07
B [200/0] via, 00:13:07
C is directly connected, Loopback102

I see that a traceroute from CPE1 to CPE2 now take the path over the HUB
and then back to the LNS as expected:

Target IP address:
Source address:
Tracing the route to
  1 72 msec 60 msec 64 msec   (Loopback102 LNS)
  2 68 msec 64 msec 64 msec   (Loopback102 HUB)
  3 72 msec 72 msec 64 msec   (Loopback102 LNS)
  4 152 msec *  148 msec        (CPE2)

When I remove the def-route on the HUB, I'am still able to reach CPE2
from CPE1 directly over the LNS:

Target IP address:
Source address:
Tracing the route to
  1 68 msec 60 msec 64 msec   (Loopback102 LNS)
  2 152 msec *  148 msec        (CPE2)

So I *can* re-direct the traffic from CPE to CPE through the HUB but in
the case the HUB fails, the CPEs are directly connected again through
the LNS/SPOKE PE. Is that the expected behaviour? Or is there still some
thing I'am missing (RPF is enabled on the Vi's)?


More information about the cisco-nsp mailing list