Skip to main content
Versa Networks

Configure Inter-AS Layer 3 VPN

  1. Last updated
  2. Save as PDF

Versa-logo-release-icon.pngFor supported software information, click here.

There are several options to connect a single tenant SD-WAN network to a legacy Multiprotocol Label Switching (MPLS) Layer 3 VPN network using Autonomous System Border Routers (ASBRs):

  • Option A—This option is also referred to as back-to-back VRF. This is the the simplest method to extend an MPLS Layer 3 VPN across two autonomous systems, as it directly runs any routing protocol between the peer routers. In option A, each ASBR holds a VRF for every shared VPN and two ASBRs consider each other as customer edge (CE) devices. The ASBRs exchange plain IPv4 routes, with no MPLS labels, over a dedicated logical interface over a routing protocol instance for each VPN. 
  • Option B—The ASBR peers exchange VPNv4 (Layer 3 VPN) routes directly over an inter-AS eBGP session using the IPv4 Layer 3 VPN unicast family. Labels are reallocated at each ASBR, so end-to-end label-switched paths (LSPs) are not required across the AS boundary.
  • Option C—End-to-end LSPs are stitched across the AS boundary using IPv4 labeled unicast between ASBR1 and ASBR2, and between the SD-WAN Controller and ASBR1. VPN routes are carried separately over a multi-hop eBGP session between the SD-WAN Controllers and the legacy MPLS route reflector (RR), with next hop unchanged so that provider edge (PE) router addresses are visible end-to-end.

This article describes Option B and Option C. 

Topology

The topology for both option B and option C consists of the following device roles:

Device Role
PE1 SD-WAN PE router that connects the SD-WAN LAN network and announces its prefixes using Layer 3 VPN to the SD-WAN Controller.
Controller SD-WAN Controller that acts as a route reflector for the SD-WAN network. In Option C, it also establishes a multi-hop eBGP session with the legacy MPLS route reflector.
ASBR1 SD-WAN ASBR that peers with ASBR2 over the inter-AS link and with the SD-WAN Controllers over the SD-WAN network. Requires a VNI interface toward ASBR2 with the MPLS family enabled.
ASBR2 Legacy MPLS ASBR that peers with ASBR1 and with the legacy MPLS route reflector.
Route Reflector Legacy MPLS route reflector. In option C, establishes a multi-hop eBGP session with the SD-WAN Controller.
PE2 Legacy MPLS PE router that connects the MPLS LAN network.

Inter-AS Layer 3 VPN Option B

In Option B, VPN labels are re-allocated at each ASBR hop. ASBR1 receives Layer 3 VPN routes from the SD-WAN Controller (originally announced by PE1), allocates new local VPN labels for those routes, and exchanges them with ASBR2 over an eBGP session using the IPv4 Layer 3 VPN unicast family.

The following figure shows the topology of the Option B network.

inter-as-option-b-topology.png

Inter-AS Layer 3 VPN Option C

In Option C, end-to-end LSPs are stitched across the AS boundary using IPv4 labeled unicast between ASBR1 and ASBR2, and between PE1 and the Controllers. VPN routes are carried separately over inet VPN unicast sessions between the SD-WAN Controller and the route-reflector. A redistribution policy on ASBR1 exports SD-WAN routes into the labeled unicast routing information base (RIB), and an export policy prevents those redistributed routes from being advertised back to the Controllers.

The following figure shows the topology of the option C network.

inter-as-option-c-topology.png

Configure Inter-AS Layer 3 VPN Option B

To configure inter-AS Layer 3 VPN option B, perform the following tasks.

Configure PE Router and Controllers

PE routers and Controllers use the standard SD-WAN branch and Controller BGP configuration. No additional BGP changes are required on these devices for Option B. For more information, see Configure BGP.

Configure Router ASBR1

To configure ASBR1 for Option B:

  1. Enable the MPLS family on the VNI interface towards ASBR2. This allows ASBR1 to accept and forward Ethernet MPLS-encapsulated packets over the VNI interface. See Configure Interfaces.

    vni-mpls.png
  2. Configure an eBGP peer group for peering with ASBR2. See Configure a BGP Peer Group.

    peer-group-l3vpn-unicast.png
  3. Select the Neighbors tab, and then configure the neighbor IP address.

    peer-group-neighbor-ip-addrress.png
  4. Select the Advanced tab and click the Nexthop Self checkbox. 

    peer-group-nexthop-self.png

Configure Inter-AS Layer 3 VPN Option C

To configure inter-AS Layer 3 VPN option C, perform the following tasks.

Configure a BGP Peer Group on the PE Router

  1. To configure the BGP peer group for the SD-WAN Controllers on PE1, enter information for the following fields. For more information, see Configure BGP.

    option-c-bgp-peer-group.png
     
    Field Description
    Name (Required) Enter a name for the peer group.
    Type Select EBGP as the type of peer group.
    General Tab  
    • Family (Required)
    		 Select IPv4 Labeled Unicast as the protocol family for the peer group. 
    • Send Label Type
    		 Select Allocate. PE1 allocates and advertises an MPLS label for each prefix it announces to the Controllers, enabling end-to-end LSP stitching across the AS boundary.

Configure eBGP Peering on Controllers

To configure the Controllers for Option C:

  1. Configure an eBGP peer group for peering with the Route-Reflector. Enter information for the following fields. For more information, see Configure BGP.

    peer-group-l3vpn-unicast.png
     
    Field Description
    Name (Required) Enter a name for the peer group.
    Type Select the type of peer group to EBGP.
    General Tab  
    • Family (Required)
    		 Select the protocol family for the peer group to IPv4 Layer 3 VNP Unicast.
    • Next Hop Unchanged
    		 Click to preserve the BGP next hop when forwarding routes to the EBGP peer.
  2. Edit the BGP peer group to peer with SD-WAN Branches. In the General tab, select the protocol family to IPv4 Layer 3 VPN Unicast.

    option-c-peer-group-branches.png

Configure Router ASBR1

To configure ASBR1 for Option C:

  1. Enable the MPLS family on the VNI interface towards the neighbor ASBR2. This allows ASBR1 to accept and forward Ethernet MPLS-encapsulated packets over the VNI interface. See Configure Interfaces.

    vni-mpls.png
  2. Configure an eBGP peer group for peering with ASBR2. See Configure a BGP Peer Group.

    peer-group-l3vpn-unicast.png
  3. Select the Neighbors tab, and then configure the neighbor IP address.

    peer-group-neighbor-ip-addrress.png
  4. Edit the BGP peer group for the SD-WAN Controllers:
    1. Select the General tab, and in the Address family drop-down list, select IPv4 Labeled Unicast.

      peer-group-l3vpn-unicast1.png
    2. Select the Advanced tab, and then click the checkbox to enable Next Hop Self.

      peer-group-nexthop-self.png
  5. Configure a redistribution policy to export SD-WAN routes into the the BGP labeled unicast RIB. 
    1. Define a redistribution policy, named r1, with two terms:
      • Term t1—Matches routes learned through SD-WAN, accepts them, and sets a BGP community string to mark the redistributed routes.
      • Term t2—Matches routes learned through SD-WAN-r, accepts them, and sets the same community string.
    2. Apply the redistribution policy to the BGP labeled unicast address family using the redistribute-to-bgp-labeled-unicast command.

      The following CLI commands show an example configuration for the routing instance Tenant1-Control-VR:
set routing-instances Tenant1-Control-VR policy-options redistribution-policy r1 term t1 match protocol sdwan
set routing-instances Tenant1-Control-VR policy-options redistribution-policy r1 term t1 action accept
set routing-instances Tenant1-Control-VR policy-options redistribution-policy r1 term t1 action set-community 1000:1000
set routing-instances Tenant1-Control-VR policy-options redistribution-policy r1 term t2 match protocol sdwan-r
set routing-instances Tenant1-Control-VR policy-options redistribution-policy r1 term t2 action accept
set routing-instances Tenant1-Control-VR policy-options redistribution-policy r1 term t2 action set-community 1000:1000
set routing-instances Tenant1-Control-VR policy-options redistribute-to-bgp-labeled-unicast r1
  1. Configure an export policy for the Controllers peer group to prevent redistributed SD-WAN routes from being advertised back to the Controllers, which creates a routing loop. Define a routing peer policy, named r1, with two terms:
    • Term t1—Matches routes that carry the community string set in Step 5 and rejects them, so that redistributed SD-WAN routes are not sent back to the Controllers.
    • Term t2—Accepts all other routes.

Apply the export policy to the Controllers peer group. The following CLI commands show an example configuration:

set routing-instances Tenant1-Control-VR protocols bgp 2 routing-peer-policy r1 term t1 match community 1000:1000
set routing-instances Tenant1-Control-VR protocols bgp 2 routing-peer-policy r1 term t1 action reject
set routing-instances Tenant1-Control-VR protocols bgp 2 routing-peer-policy r1 term t2 action accept
set routing-instances Tenant1-Control-VR protocols bgp 2 group Controllers-Group export r1

Monitor BGP Labeled Unicast Routes

To monitor advertised and received BGP labeled unicast routes:

  1. In Director view, select Monitor > Devices, and then select an organization in the Organization field.
  2. Select the Devices tab, and then select a device in the Appliances home screen. The screen changes to Appliance view and a new tab opens to display information for the device.
  3. To view advertised IPv4 labeled unicast routes, click Networking > BGP > Advertised Prefixes tab, and then select the address family.

    monitor-advt-prefix.png
  4. To view received IPv4 labeled unicast routes, select the Networking > BGP > Received Prefixes tab, and then select the address family.

    monitor-received-prefix.png

Supported Software Information

Releases 23.1.1 and later support all content described in this article.

  1. Back to top
  • Was this article helpful?

Recommended articles

  1. Page type
    Topic
  2. Tags
    This page has no tags.