H3C S5130S-HI Series User manual

MCE Configuration Guide
This configuration guide is applicable to the following switches and software versions:
H3C S5130S-HI switch series (Release 6308 and later)
H3C S5130S-EI switch series (Release 6308 and later)
H3C S5130S-SI switch series (Release 6310 and later)
H3C S5120V2-SI switch series (Release 6310 and later)
H3C S3100V3-EI switch series (Release 6309P01 and later)
H3C E500C switch series (Release 6309P01 and later)
H3C E500D switch series (Release 6309P01 and later)
H3C E128C & E152C switches (Release 6310 and later)
New H3C Technologies Co., Ltd.
http://www.h3c.com
Software version: Release 63xx
Document version: 6W103-20210730

Copyright © 2021, New H3C Technologies Co., Ltd. and its licensors
All rights reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior written
consent of New H3C Technologies Co., Ltd.
Trademarks
Except for the trademarks of New H3C Technologies Co., Ltd., any trademarks that may be mentioned in this
document are the property of their respective owners.
Notice
The information in this document is subject to change without notice. All contents in this document, including
statements, information, and recommendations, are believed to be accurate, but they are presented without
warranty of any kind, express or implied. H3C shall not be liable for technical or editorial errors or omissions
contained herein.

Preface
This configuration guide describes the MCE fundamentals and configuration procedures.
This preface includes the following topics about the documentation:
•
Audience
•
Conventions
•
Obtaining documentation
•
Technical support
•
Documentation feedback
Audience
This documentation is intended for:
•
Network planners.
•
Field technical support and servicing engineers.
•
Network administrators working with the S6800 switch series.
Conventions
The following information describes the conventions used in the documentation.
Command conventions
Convention
Description
Boldface Bold text represents commands and keywords that you enter literally as shown.
Italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars, from which
you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical bars,
from which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by vertical
bars, from which you select a minimum of one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntaxchoices separated by vertical
bars, from which you select one choice, multiple choices, or none.
&<1-n> The argument or keyword and argument combination before the ampersand (&) sign
can be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention
Description
Boldface Window names, button names, field names, and menu items are in Boldface. For
example, the New User window opens; click OK.
>
Multi-level menus are separated by angle brackets. For example, File > Create >

Convention
Description
Folder.
Symbols
Convention
Description
WARNING!
An alert that calls attention to important information that if not understood or followed
can result in personal injury.
CAUTION:
An alert that calls attention to important information that if not understood or followed
can result in data loss, data corruption, or damage to hardware or software.
IMPORTANT:
An alert that calls attention to essential information.
NOTE:
An alert that contains additional or supplementary information.
TIP:
An alert that provides helpful information.
Network topology icons
Convention
Description
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that
supports Layer 2 forwarding and other Layer 2 features.
Represents an access controller, a unified wired-WLAN module, or the access
controller engine on a unified wired-WLAN switch.
Represents an access point.
Represents a wireless terminator unit.
Represents a wireless terminator.
Represents a mesh access point.
Represents omnidirectional signals.
Represents directional signals.
Represents a security product, such as a firewall, UTM, multiservice security
gateway, or load balancing device.
Represents a security module, such as a firewall, load balancing, NetStream, SSL
VPN, IPS, or ACG module.
T
T
T
T

Examples provided in this document
Examples in this document might use devices that differ from your device in hardware model,
configuration, or software version. It is normal that the port numbers, sample output, screenshots,
and other information in the examples differ from what you have on your device.
Obtaining documentation
To access the most up-to-date H3C product documentation, go to the H3C website at
http://www.h3c.com.hk
To obtain information about installation, configuration, and maintenance, click
http://www.h3c.com.hk/Technical_Documents
To obtain software version information such as release notes, click
http://www.h3c.com.hk/Software_Download
Technical support
[e-mail]
http://www.h3c.com.hk
Documentation feedback
You can e-mail your comments about product documentation to [e-mail].
We appreciate your comments.

i
Contents
Configuring MCE ···························································································1
About MCE·························································································································································1
MPLS L3VPN problems solved by MCE····································································································1
Basic MPLS L3VPN architecture ···············································································································1
MCE-related MPLS L3VPN concepts ········································································································2
MCE working mechanism ··························································································································3
Restrictions and guidelines: MCE configuration·································································································4
MCE tasks at a glance·······································································································································4
Configuring VPN instances································································································································5
Creating a VPN instance····························································································································5
Associating a VPN instance with a Layer 3 interface·················································································5
Configuring route related attributes for a VPN instance·············································································6
Configuring routing between an MCE and a VPN site·······················································································6
Configuring static routing between an MCE and a VPN site······································································6
Configuring RIP between an MCE and a VPN site····················································································7
Configuring OSPF between an MCE and a VPN site ················································································7
Configuring routing between an MCE and a PE ································································································8
About routing between an MCE and a PE ·································································································8
Configuring static routing between an MCE and a PE···············································································8
Configuring RIP between an MCE and a PE ·····························································································9
Configuring OSPF between an MCE and a PE··························································································9
Display and maintenance commands for MCE··································································································9
MCE configuration examples···························································································································10
Example: Configuring the MCE that uses OSPF to advertise VPN routes to the PE·······························10
Configuring IPv6 MCE·················································································15
About IPv6 MCE···············································································································································15
Restrictions and guidelines: IPv6 MCE configuration ······················································································15
IPv6 MCE tasks at a glance·····························································································································15
Configuring VPN instances······························································································································15
Creating a VPN instance··························································································································15
Associating a VPN instance with a Layer 3 interface···············································································16
Configuring route related attributes for a VPN instance···········································································16
Configuring routing between an MCE and a VPN site·····················································································17
Configuring IPv6 static routing between an MCE and a VPN site····························································17
Configuring RIPng between an MCE and a VPN site··············································································18
Configuring OSPFv3 between an MCE and a VPN site···········································································18
Configuring routing between an MCE and a PE ······························································································19
About routing between an MCE and a PE ·······························································································19
Configuring IPv6 static routing between an MCE and a PE·····································································19
Configuring RIPng between an MCE and a PE ·······················································································19
Configuring OSPFv3 between an MCE and a PE····················································································20
Display and maintenance commands for IPv6 MCE························································································20
IPv6 MCE configuration examples···················································································································21
Example: Configuring IPv6 MCE··············································································································21

1
Configuring MCE
About MCE
The Multi-VPN Instance Customer Edge (MCE) feature allows multiple VPNs to share a CE with
ensured data security in an MPLS L3VPN network. MCE provides traffic separation between VPNs
by distinguishing routes of the VPNs.
MPLS L3VPN problems solved by MCE
MPLS L3VPN is a L3VPN technology used to interconnect geographically dispersed VPN sites.
MPLS L3VPN uses BGP to advertise VPN routes and uses MPLS to forward VPN packets over a
service provider backbone.
In conventional MPLS L3VPN, a VPN site must exclusively use a CE to connect a PE. With
increasing business, a private network must be divided into multiple VPNs and the VPNs must be
isolated from one another for data security. Using a CE exclusively for each VPN costs much in
buying and maintaining the network devices. Using a common CE for multiple VPNs cannot ensure
data security because the VPNs use the same routing table.
The MCE feature offers balance between cost and security. It creates multiple VPN instances on a
CE to provide logically separated routing tables and address spaces for the VPNs, so the VPNs can
share the CE. This CE is called the MCE device.
Basic MPLS L3VPN architecture
A basic MPLS L3VPN architecture has the following types of devices:
•
Customer edge device—A CE device resides on a customer network and has one or more
interfaces directly connected to a service provider network. It does not support MPLS.
•
Provider edge device—A PE device resides at the edge of a service provider network and is
connected to one or more CEs. All MPLS VPN services are processed on PEs.
•
Provider device—A P device is a core device on a service provider network. It is not directly
connected to any CEs. A P device has only basic MPLS forwarding capability and does not
handle VPN routing information.

2
Figure 1 Basic MPLS L3VPN architecture
MCE-related MPLS L3VPN concepts
Site
A site has the following features:
•
A site is a group of IP systems with IP connectivity that does not rely on any service provider
networks.
•
The classification of a site depends on the topology relationship of the devices, rather than the
geographical positions. However, the devices at a site are, in most cases, adjacent to each
other geographically.
•
The devices at a site can belong to multiple VPNs, which means that a site can belong to
multiple VPNs.
•
A site is connected to a provider network through one or more CEs. A site can contain multiple
CEs, but a CE can belong to only one site.
Sites connected to the same provider network can be classified into different sets by policies. Only
the sites in the same set can access each other through the provider network. Such a set is called a
VPN.
VPN instance
VPN instances implement route isolation, data independence, and data security for VPNs.
A VPN instance has the following components:
•
A separate Label Forwarding Information Base (LFIB).
•
An IP routing table.
•
Interfaces bound to the VPN instance.
•
VPN instance administration information, including route distinguishers (RDs), route targets
(RTs), and route filtering policies.
To associate a site with a VPN instance, bind the VPN instance to the PE's interface connected to the
site. A site can be associated with only one VPN instance, and different sites can be associated with
the same VPN instance. A VPN instance contains the VPN membership and routing rules of
associated sites.
VPN 1
CE
Site 1
VPN 2
CE
CE
CE
Site 3
VPN 2
PE
VPN 1
Site 2
Site 4
PE
PE
P P
PP

3
VPN-IPv4 address
Each VPN independently manages its address space. The address spaces of VPNs might overlap.
For example, if both VPN 1 and VPN 2 use the addresses on subnet 10.110.10.0/24, address space
overlapping occurs.
Multiprotocol BGP (MP-BGP) can solve this problem by advertising VPN-IPv4 addresses (also
called VPNv4 addresses).
As shown in Figure 2, a VPN-IPv4 address consists of 12 bytes. The first eight bytes represent the
RD, followed by a four-byte IPv4 prefix. The RD and the IPv4 prefix form a unique VPN-IPv4 prefix.
Figure 2 VPN-IPv4 address structure
An RD can be in one of the following formats:
•
When the Type field is 0, the Administrator subfield occupies two bytes, the Assigned number
subfield occupies four bytes, and the RD format is 16-bit AS number:32-bit user-defined
number. For example, 100:1.
•
When the Type field is 1, theAdministrator subfield occupies four bytes, the Assigned number
subfield occupies two bytes, and the RD format is 32-bit IPv4 address:16-bit user-defined
number. For example, 172.1.1.1:1.
•
When the Type field is 2, the Administrator subfield occupies four bytes, the Assigned number
subfield occupies two bytes, and the RD format is 32-bit AS number:16-bit user-defined number,
where the minimum value of the AS number is 65536. For example, 65536:1.
To guarantee global uniqueness for a VPN-IPv4 address, do not set the Administrator subfield to any
private AS number or private IP address.
Route target attribute
MPLS L3VPN uses route target community attributes to control the advertisement of VPN routing
information. A VPN instance on a PE supports the following types of route target attributes:
•
Export target attribute—A PE sets the export target attribute for VPN-IPv4 routes learned
from directly connected sites before advertising them to other PEs.
•
Import target attribute—A PE checks the export target attribute of VPN-IPv4 routes received
from other PEs. If the export target attribute matches the import target attribute of a VPN
instance, the PE adds the routes to the routing table of the VPN instance.
Route target attributes define which sites can receive VPN-IPv4 routes, and from which sites a PE
can receive routes.
Like RDs, route target attributes can be one of the following formats:
•
16-bit AS number:32-bit user-defined number. For example, 100:1.
•
32-bit IPv4 address:16-bit user-defined number. For example, 172.1.1.1:1.
•
32-bit AS number:16-bit user-defined number, where the minimum value of the AS number is
65536. For example, 65536:1.
MCE working mechanism
As shown in Figure 3, the MCE exchanges private routes with VPN sites and PE 1, and adds the
private routes to the routing tables of corresponding VPN instances.
Type
2 bytes 4 bytes
IPv4 address prefix
6 bytes
Route Distinguisher (8 bytes)
Assigned number subfieldAdministrator subfield

4
•
Route exchange between MCE and VPN site—Create VPN instances VPN 1 and VPN 2 on
the MCE. Bind VLAN-interface 2 to VPN 1, and VLAN-interface 3 to VPN 2. The MCE adds a
received route to the routing table of the VPN instance that is bound to the receiving interface.
•
Route exchange between MCE and PE—The MCE connects to PE 1 through trunk links. On
PE 1, create VPN instances for VPN 1 and VPN 2. Bind VLAN-interface 2 to VPN 1, and
VLAN-interface 3 to VPN 2. The MCE and PE add a received route to the routing table of the
VPN instance that is bound to the receiving interface.
Figure 3 Network diagram for the MCE feature
You can configure static routes, RIP, or OSPF between an MCE and a VPN site and between an
MCE and a PE.
NOTE:
To implement dynamic IP assignment for DHCP
clients in private networks, you can configure
DHCP server or DHCP relay agent on the MCE.
When the MCE functions as the DHCP server, t
he
IP addresses assigned to different private networks cannot overlap.
Restrictions and guidelines: MCE configuration
On the PE, disable routing loop detection to avoid route loss during route calculation, and disable
route redistribution between routing protocols to save system resources.
MCE tasks at a glance
To configure MCE, perform the following tasks:
1. Configuring VPN instances
Perform the following VPN instance tasks on PEs and MCEs:
a. Creating a VPN instance
b. Associating a VPN instance with a Layer 3 interface
c. (Optional.) Configuring route related attributes for a VPN instance
2. Configuring routing between an MCE and a VPN site
VPN 1
Site 1
VPN 2
Site 2 CE
CE
VPN 2
Site 3
VPN 1
Site 4
PE 3
PE 2
P
P
Vlan-int2
Vlan-int3
MCE PE 1
Vlan-int2
Vlan-int3
Vlan-int2
Vlan-int3

5
3. Configuring routing between an MCE and a PE
Configuring VPN instances
Creating a VPN instance
About VPN instances
AVPN instance is a collection of the VPN membership and routing rules of its associated site. AVPN
instance might correspond to more than one VPN.
Procedure
1. Enter system view.
system-view
2. Create a VPN instance and enter VPN instance view.
ip vpn-instance vpn-instance-name
3. Configure an RD for the VPN instance.
route-distinguisher route-distinguisher
By default, no RD is configured for a VPN instance.
4. (Optional.) Configure a description for the VPN instance.
description text
By default, no description is configured for a VPN instance.
5. (Optional.) Configure a VPN ID for the VPN instance.
vpn-id vpn-id
By default, no VPN ID is configured for a VPN instance.
Associating a VPN instance with a Layer 3 interface
1. Enter system view.
system-view
2. Enter interface view.
interface interface-type interface-number
This interface connects the device to the CE.
3. Associate a VPN instance with the interface.
ip binding vpn-instance vpn-instance-name
By default, an interface is not associated with a VPN instance and it belongs to the public
network.
CAUTION:
A
ssociating a VPN instance with an interface or disassociating a VPN instance from an
interface will clear the IP address and routing protocol settings of the interface.
Configuration of this command deletes the IP address of the current interface. You must
reconfigure an IP address for the interface after configuring the command.

6
Configuring route related attributes for a VPN instance
Restrictions and guidelines
If you configure route related attributes in both VPN instance view and VPN instance IPv4 address
family view, IPv4 VPN uses the configuration in VPN instance IPv4 address family view.
Prerequisites
Before you perform this task, create the routing policies to be used by this task. For information about
routing policies, see Layer 3—IP Routing Configuration Guide.
Procedure
1. Enter system view.
system-view
2. Enter VPN instance view or VPN instance IPv4 address family view.
Enter VPN instance view.
ip vpn-instance vpn-instance-name
Execute the following commands in sequence to enter VPN instance IPv4 address family
view:
ip vpn-instance vpn-instance-name
address-family ipv4
3. Configure route targets.
vpn-target vpn-target&<1-8> [both |export-extcommunity |
import-extcommunity ]
By default, no route targets are configured.
4. Set the maximum number of active routes.
routing-table limit number {warn-threshold |simply-alert }
By default, the number of active routes in a VPN instance is not limited.
Setting the maximum number of active routes for a VPN instance can prevent the device from
learning too many routes.
5. Apply an import routing policy.
import route-policy route-policy
By default, all routes matching the import target attribute are accepted.
6. Apply an export routing policy.
export route-policy route-policy
By default, routes to be advertised are not filtered.
Configuring routing between an MCE and a VPN
site
Configuring static routing between an MCE and a VPN site
About static routing between an MCE and a VPN site
An MCE can reach a VPN site through a static route. Static routing on a traditional CE is globally
effective and does not support address overlapping among VPNs. An MCE supports binding a static
route to a VPN instance, so that the static routes of different VPN instances can be isolated from
each other.

7
Perform this configuration on the MCE. On the VPN site, configure a common static route.
Procedure
1. Enter system view.
system-view
2. Configure a static route for a VPN instance.
ip route-static vpn-instance s-vpn-instance-name dest-address
{mask-length |mask }{interface-type interface-number
[next-hop-address ]|next-hop-address [public ]|vpn-instance
d-vpn-instance-name next-hop-address }
3. (Optional.) Configure the default preference for static routes.
ip route-static default-preference default-preference
The default preference is 60.
Configuring RIP between an MCE and a VPN site
About RIP between an MCE and a VPN site
Binding RIP processes to VPN instances can isolate routes of different VPNs. For more information
about RIP, see Layer 3—IP Routing Configuration Guide.
Perform this configuration on the MCE. On a VPN site, create a common RIP process.
Procedure
1. Enter system view.
system-view
2. Create a RIP process for a VPN instance and enter RIP view.
rip [process-id ]vpn-instance vpn-instance-name
A RIP process can belong to only one VPN instance.
3. Enable RIP on the interface attached to the specified network.
network network-address [wildcard-mask ]
By default, RIP is disabled on an interface.
4. Redistribute remote site routes advertised by the PE into RIP.
import-route protocol [as-number ][process-id |all-processes ]
[allow-direct |cost cost-value |route-policy route-policy-name |tag
tag ]*
By default, no route is redistributed into RIP.
Configuring OSPF between an MCE and a VPN site
About OSPF between an MCE and a VPN site
Binding OSPF processes to VPN instances can isolate routes of different VPNs. For more
information about OSPF, see Layer 3—IP Routing Configuration Guide.
Perform this configuration on the MCE. On a VPN site, create a common OSPF process.
Procedure
1. Enter system view.
system-view
2. Create an OSPF process for a VPN instance and enter OSPF view.

8
ospf [process-id ]router-id router-id vpn-instance vpn-instance-name
Keywords
Usage guidelines
router-id
router-id
An OSPF process that is bound to a VPN instance does not use the
public network router ID configured in system view. Therefore, you must
specify a router ID when creating a process or configure an IP address
for a minimum of one interface in the VPN instance.
vpn-instance
vpn-instance-name
An OSPF process can belong to only one VPN instance.
If you delete a VPN instance, all OSPF processes of the VPN instance
are also deleted.
3. Redistribute remote site routes advertised by the PE into OSPF.
import-route protocol [as-number ] [ process-id |all-processes ]
[allow-direct |cost cost-value |nssa-only |route-policy
route-policy-name |tag tag |type type ]*
By default, no routes are redistributed into OSPF.
4. Create an OSPF area and enter OSPF area view.
area area-id
5. Enable OSPF on the interface attached to the specified network in the area.
network ip-address wildcard-mask
By default, an interface neither belongs to any area nor runs OSPF.
Configuring routing between an MCE and a PE
About routing between an MCE and a PE
MCE-PE routing configuration includes these tasks:
•
Binding the MCE-PE interfaces to VPN instances.
•
Performing route configurations.
•
Redistributing VPN routes into the routing protocol running between the MCE and the PE.
Perform the following configurations on the MCE. For information about configuring the PE, see the
documentation for the PE.
Configuring static routing between an MCE and a PE
1. Enter system view.
system-view
2. Configure a static route for a VPN instance.
ip route-static vpn-instance s-vpn-instance-name dest-address
{mask-length |mask }{interface-type interface-number
[next-hop-address ]|next-hop-address [public ]|vpn-instance
d-vpn-instance-name next-hop-address }
3. (Optional.) Set the default preference for static routes.
ip route-static default-preference default-preference
The default preference is 60.

9
Configuring RIP between an MCE and a PE
1. Enter system view.
system-view
2. Create a RIP process for a VPN instance and enter RIP view.
rip [process-id ]vpn-instance vpn-instance-name
3. Enable RIP on the interface attached to the specified network.
network network-address [wildcard-mask ]
By default, RIP is disabled on an interface.
4. Redistribute the VPN routes.
import-route protocol [as-number ] [ process-id |all-processes ]
[allow-direct |cost cost-value |route-policy route-policy-name |tag
tag ]*
By default, no routes are redistributed into RIP.
Configuring OSPF between an MCE and a PE
1. Enter system view.
system-view
2. Create an OSPF process for a VPN instance and enter OSPF view.
ospf [process-id |router-id router-id |vpn-instance
vpn-instance-name ]*
3. Disable routing loop detection.
vpn-instance-capability simple
By default, routing loop detection is enabled and the MCE does not receive OSPF routes from
the PE.
4. Redistribute the VPN routes.
import-route protocol [as-number ] [ process-id |all-processes ]
[allow-direct |cost cost-value |nssa-only |route-policy
route-policy-name |tag tag |type type ]*
By default, no routes are redistributed into OSPF.
5. Create an OSPF area and enter OSPF area view.
area area-id
6. Enable OSPF on the interface attached to the specified network in the area.
network ip-address wildcard-mask
By default, an interface neither belongs to an area nor runs OSPF.
Display and maintenance commands for MCE
Execute display commands in any view.
Task
Command
Display VPN instance information.
display ip vpn-instance
[
instance-name
vpn-instance-name
]

10
For commands that display routing tables for VPN instances, see Layer 3—IP Routing Command
Reference.
MCE configuration examples
Example: Configuring the MCE that uses OSPF to advertise
VPN routes to the PE
Network configuration
As shown in Figure 4, VPN 2 runs OSPF. The edge devices of VPN 1 and VPN 2 are VR 1 and VR 2,
respectively. Configure the MCE device to separate routes from different VPNs and to advertise the
VPN routes to PE 1 through OSPF.
Figure 4 Network diagram
Procedure
1. Configure the VPN instances on the MCE and PE 1:
# On the MCE, configure VPN instances vpn1 and vpn2, and specify an RD and route targets
for each VPN instance.
<MCE> system-view
[MCE] ip vpn-instance vpn1
[MCE-vpn-instance-vpn1] route-distinguisher 10:1
[MCE-vpn-instance-vpn1] vpn-target 10:1
[MCE-vpn-instance-vpn1] quit
[MCE] ip vpn-instance vpn2
[MCE-vpn-instance-vpn2] route-distinguisher 20:1
CE 2
VPN 1
Site 2
CE 1
VPN 2
Site 1
PE 1
PE 3
PE 2
VPN 2
192.168.10.0/24
VR 2
VPN 1
192.168.0.0/24 VR 1
MCE
Vlan-int10
10.214.10.3/24
Vlan-int30: 30.1.1.2/24
Vlan-int40: 40.1.1.2/24
Vlan-int30: 30.1.1.1/24
Vlan-int40: 40.1.1.1/24
Vlan-int20
10.214.20.3/24

11
[MCE-vpn-instance-vpn2] vpn-target 20:1
[MCE-vpn-instance-vpn2] quit
# Bind VLAN-interface 10 to VPN instance vpn1, and configure an IP address for the VLAN
interface.
[MCE] interface vlan-interface 10
[MCE-Vlan-interface10] ip binding vpn-instance vpn1
[MCE-Vlan-interface10] ip address 10.214.10.3 24
[MCE-Vlan-interface10] quit
# Bind VLAN-interface 20 to VPN instance vpn2, and configure an IP address for the VLAN
interface.
[MCE] interface vlan-interface 20
[MCE-Vlan-interface20] ip binding vpn-instance vpn2
[MCE-Vlan-interface20] ip address 10.214.20.3 24
[MCE-Vlan-interface20] quit
# On PE 1, configure VPN instances vpn1 and vpn2, and specify an RD and route targets for
each VPN instance.
<PE1> system-view
[PE1] ip vpn-instance vpn1
[PE1-vpn-instance-vpn1] route-distinguisher 10:1
[PE1-vpn-instance-vpn1] vpn-target 10:1
[PE1-vpn-instance-vpn1] quit
[PE1] ip vpn-instance vpn2
[PE1-vpn-instance-vpn2] route-distinguisher 20:1
[PE1-vpn-instance-vpn2] vpn-target 20:1
[PE1-vpn-instance-vpn2] quit
2. Configure routing between the MCE and VPN sites:
The MCE is connected to VPN 1 directly, and no routing protocol is enabled in VPN 1.
Therefore, you can configure static routes.
# On VR 1, assign IP address 10.214.10.2/24 to the interface connected to MCE and
192.168.0.1/24 to the interface connected to VPN 1. Add ports to VLANs correctly. (Details not
shown.)
# On VR 1, configure a default route with the next hop being 10.214.10.3.
<VR1> system-view
[VR1] ip route-static 0.0.0.0 0.0.0.0 10.214.10.3
# On the MCE, configure a static route to 192.168.0.0/24 with the next hop 10.214.10.2. Bind
the static route to VPN instance vpn1.
[MCE] ip route-static vpn-instance vpn1 192.168.0.0 24 10.214.10.2
# On the MCE, display the routing information maintained for VPN instance vpn1.
[MCE] display ip routing-table vpn-instance vpn1
Destinations : 13 Routes : 13
Destination/Mask Proto Pre Cost NextHop Interface
0.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
10.214.10.0/24 Direct 0 0 10.214.10.3 Vlan10
10.214.10.0/32 Direct 0 0 10.214.10.3 Vlan10
10.214.10.3/32 Direct 0 0 127.0.0.1 InLoop0
10.214.10.255/32 Direct 0 0 10.214.10.3 Vlan10
127.0.0.0/8 Direct 0 0 127.0.0.1 InLoop0

12
127.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
127.0.0.1/32 Direct 0 0 127.0.0.1 InLoop0
127.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
192.168.0.0/24 Static 60 0 10.214.10.2 Vlan10
224.0.0.0/4 Direct 0 0 0.0.0.0 NULL0
224.0.0.0/24 Direct 0 0 0.0.0.0 NULL0
255.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
The output shows that the MCE has a static route for VPN instance vpn1.
# Run OSPF in VPN 2. Create OSPF process 20 and bind it to VPN instance vpn2 on the MCE,
so that the MCE can learn the routes of VPN 2 and add them to the routing table of VPN
instance vpn2.
[MCE] ospf 2 vpn-instance vpn2
# Advertise subnet 10.214.20.0.
[MCE-ospf-2] area 0
[MCE-ospf-2-area-0.0.0.0] network 10.214.20.0 0.0.0.255
[MCE-ospf-2-area-0.0.0.0] quit
[MCE-ospf-2] quit
# On VR 2, assign IP address 10.214.20.2/24 to the interface connected to MCE and
192.168.10.1/24 to the interface connected to VPN 2. (Details not shown.)
# Configure OSPF process 2, and advertise subnets 192.168.10.0 and 10.214.20.0.
<VR2> system-view
[VR2] ospf 2
[VR2-ospf-2] area 0
[VR2-ospf-2-area-0.0.0.0] network 192.168.10.0 0.0.0.255
[VR2-ospf-2-area-0.0.0.0] network 10.214.20.0 0.0.0.255
[VR2-ospf-2-area-0.0.0.0] quit
[VR2-ospf-2] quit
# On the MCE, display the routing information maintained for VPN instance vpn2.
[MCE] display ip routing-table vpn-instance vpn2
Destinations : 13 Routes : 13
Destination/Mask Proto Pre Cost NextHop Interface
0.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
10.214.20.0/24 Direct 0 0 10.214.20.3 Vlan20
10.214.20.0/32 Direct 0 0 10.214.20.3 Vlan20
10.214.20.3/32 Direct 0 0 127.0.0.1 InLoop0
10.214.20.255/32 Direct 0 0 10.214.20.3 Vlan20
127.0.0.0/8 Direct 0 0 127.0.0.1 InLoop0
127.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
127.0.0.1/32 Direct 0 0 127.0.0.1 InLoop0
127.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
192.168.10.0/24 O_INTRA 10 2 10.214.20.2 Vlan20
224.0.0.0/4 Direct 0 0 0.0.0.0 NULL0
224.0.0.0/24 Direct 0 0 0.0.0.0 NULL0
255.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
The output shows that the MCE has learned the private routes of VPN 2. The MCE maintains
the routes of VPN 1 and those of VPN2 in two different routing tables. In this way, routes from
different VPNs are separated.

13
3. Configure routing between the MCE and PE 1:
# On the MCE, bind VLAN-interface 30 to VPN instance vpn1, and configure an IP address for
the VLAN interface.
[MCE] interface vlan-interface 30
[MCE-Vlan-interface30] ip binding vpn-instance vpn1
[MCE-Vlan-interface30] ip address 30.1.1.1 24
[MCE-Vlan-interface30] quit
# Bind VLAN-interface 40 to VPN instance vpn2, and configure an IP address for the VLAN
interface.
[MCE] interface vlan-interface 40
[MCE-Vlan-interface40] ip binding vpn-instance vpn2
[MCE-Vlan-interface40] ip address 40.1.1.1 24
[MCE-Vlan-interface40] quit
# On PE 1, bind VLAN-interface 30 to VPN instance vpn1, and configure an IP address for the
VLAN interface.
[PE1] interface vlan-interface 30
[PE1-Vlan-interface30] ip binding vpn-instance vpn1
[PE1-Vlan-interface30] ip address 30.1.1.2 24
[PE1-Vlan-interface30] quit
# Bind VLAN-interface 40 to VPN instance vpn2, and configure an IP address for the VLAN
interface.
[PE1] interface vlan-interface 40
[PE1-Vlan-interface40] ip binding vpn-instance vpn2
[PE1-Vlan-interface40] ip address 40.1.1.2 24
[PE1-Vlan-interface40] quit
# Configure the IP address of the interface Loopback 0 as 101.101.10.1 for the MCE and as
100.100.10.1 for PE 1. Specify the loopback interface address as the router ID for the MCE and
PE 1. (Details not shown.)
# Enable OSPF process 10 on the MCE, and bind the process to VPN instance vpn1.
[MCE] ospf 10 router-id 101.101.10.1 vpn-instance vpn1
# Disable OSPF routing loop detection for the VPN instance.
[MCE-ospf-10] vpn-instance-capability simple
# Set the domain ID to 10.
[MCE-ospf-10] domain-id 10
# On the MCE, advertise subnet 30.1.1.0 in area 0, and redistribute the static route of VPN 1.
[MCE-ospf-10] area 0
[MCE-ospf-10-area-0.0.0.0] network 30.1.1.0 0.0.0.255
[MCE-ospf-10-area-0.0.0.0] quit
[MCE-ospf-10] import-route static
# On PE 1, enable OSPF process 10, and bind the process to VPN instance vpn1.
[PE1] ospf 10 router-id 100.100.10.1 vpn-instance vpn1
# Set the domain ID to 10.
[PE1-ospf-10] domain-id 10
# Advertise subnet 30.1.1.0 in area 0.
[PE1-ospf-10] area 0
[PE1-ospf-10-area-0.0.0.0] network 30.1.1.0 0.0.0.255
[PE1-ospf-10-area-0.0.0.0] quit
[PE1-ospf-10] quit

14
# Use similar procedures to configure OSPF process 20 between MCE and PE 1 and
redistribute VPN 2's routing information. (Details not shown.)
Verifying the configuration
# Verify that PE 1 has learned the static route of VPN 1 through OSPF.
[PE1] display ip routing-table vpn-instance vpn1
Destinations : 13 Routes : 13
Destination/Mask Proto Pre Cost NextHop Interface
0.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
30.1.1.0/24 Direct 0 0 30.1.1.2 Vlan30
30.1.1.0/32 Direct 0 0 30.1.1.2 Vlan30
30.1.1.2/32 Direct 0 0 127.0.0.1 InLoop0
30.1.1.255/32 Direct 0 0 30.1.1.2 Vlan30
127.0.0.0/8 Direct 0 0 127.0.0.1 InLoop0
127.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
127.0.0.1/32 Direct 0 0 127.0.0.1 InLoop0
127.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
192.168.0.0/24 O_ASE2 150 1 30.1.1.1 Vlan30
224.0.0.0/4 Direct 0 0 0.0.0.0 NULL0
224.0.0.0/24 Direct 0 0 0.0.0.0 NULL0
255.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
# Verify that PE 1 has learned the routes of OSPF process 20 in VPN 2 through OSPF.
[PE1] display ip routing-table vpn-instance vpn2
Destinations : 13 Routes : 13
Destination/Mask Proto Pre Cost NextHop Interface
0.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
40.1.1.0/24 Direct 0 0 40.1.1.2 Vlan40
40.1.1.0/32 Direct 0 0 40.1.1.2 Vlan40
40.1.1.2/32 Direct 0 0 127.0.0.1 InLoop0
40.1.1.255/32 Direct 0 0 40.1.1.2 Vlan40
127.0.0.0/8 Direct 0 0 127.0.0.1 InLoop0
127.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
127.0.0.1/32 Direct 0 0 127.0.0.1 InLoop0
127.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
192.168.10.0/24 O_ASE2 150 1 40.1.1.1 Vlan40
224.0.0.0/4 Direct 0 0 0.0.0.0 NULL0
224.0.0.0/24 Direct 0 0 0.0.0.0 NULL0
255.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
The routing information for the two VPNs has been redistributed into the routing tables on PE 1.