H3C S5820V2H User manual

H3C S5830V2 & S5820V2 Switch Series
MCE Configuration Guide
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Software version: Release 22xx
Document version: 6W100-20131105

Copyright © 2013, Hangzhou H3C Technologies Co., Ltd. and its licensors
All rights reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , Aolynk, , H3Care, , TOP G, , IRF, NetPilot, Neocean, NeoVTL,
SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V2G, VnG, PSPT,
XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,
Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface
The H3C S5830V2 & S5820V2 documentation set includes 14 configuration guides, which describe the
software features for the H3C S5830V2 & S5820V2 Switch Series and guide you through the software
configuration procedures. These configuration guides also provide configuration examples to help you
apply software features to different network scenarios.
The MCE Configuration Guide describes MCE fundamentals and the configuration on the switch that
acts as an MCE.
This preface includes:
•Audience
•Added and modified features
•Conventions
•About the H3C S5830V2 & S5820V2 documentation set
•Obtaining documentation
•Technical support
•Documentation feedback
Audience
This documentation is intended for:
•Network planners
•Field technical support and servicing engineers
•Network administrators working with the S5830V2 & S5820V2 series
Added and modified features
This documentation set is for Release 22xx. The following describes the feature changes between
releases:
•Release 2210 does not have feature changes over Release 2208P01.
•Release 2208P01 does not have feature changes over Release 2208.
•Release 2208 has the following feature changes over Release 2108P02:
Confi
g
uration
g
uide Added and modified features
MCE
Added features:
•Configuring RIP between an MCE and a VPN site.
•Configuring IS-IS between an MCE and a VPN site.
•Configuring RIP between an MCE and a PE.
•Configuring IS-IS between an MCE and a PE.
IPv6 MCE Added features: Configuring IPv6 MCE.

Conventions
This section describes the conventions used in this documentation set.
Command conventions
Convention Descri
p
tion
Boldface Bold text represents commands and keywords that you enter literally as shown.
Italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars, from which
you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical bars, from
which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by vertical
bars, from which you select at least one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax choices separated by vertical
bars, from which you select one choice, multiple choices, or none.
&<1-n> The argument or keyword and argument combination before the ampersand (&) sign can
be entered 1 to n times.
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention Descri
p
tion
Boldface Window names, button names, field names, and menu items are in bold text. For
example, the New User window appears; click OK.
> Multi-level menus are separated by angle brackets. For example, File >Create >Folder.
Symbols
Convention Descri
p
tion
WARNING An alert that calls attention to important information that if not understood or followed can
result in personal injury.
CAUTION An alert that calls attention to important information that if not understood or followed can
result in data loss, data corruption, or damage to hardware or software.
IMPORTANT An alert that calls attention to essential information.
NOTE An alert that contains additional or supplementary information.
TIP An alert that provides helpful information.
Network topology icons
Represents a generic network device, such as a router, switch, or firewall.

Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports
Layer 2 forwarding and other Layer 2 features.
Port numbering in examples
The port numbers in this document are for illustration only and might be unavailable on your switch.
About the H3C S5830V2 & S5820V2
documentation set
The H3C S5830V2&S5820V2 documentation set includes:
Cate
g
or
y
Documents Pur
p
oses
Hardware specifications
and installation
Compliance and safety
manual
Provides regulatory information and the safety
instructions that must be followed during installation.
Installation quick start Provides basic installation instructions.
Installation guide Provides a complete guide to hardware installation
and hardware specifications.
Fan assemblies
installation manual
Describes the appearance, specifications, and
installation and removal of hot-swappable fan
assemblies.
Power modules user
manual
Describes the appearance, specifications, and
installation and removal of hot-swappable power
modules.
Software configuration
Configuration guides Describe software features and configuration
procedures.
Command references Provide a quick reference to all available
commands.
Obtaining documentation
You can access the most up-to-date H3C product documentation on the World Wide Web
at http://www.h3c.com.
Click the links on the top navigation bar to obtain different categories of product documentation:
[Technical Support & Documents > Technical Documents] – Provides hardware installation, software
upgrading, and software feature configuration and maintenance documentation.
[Products & Solutions] – Provides information about products and technologies.
[Technical Support & Documents > Software Download] – Provides the documentation released with the
software version.

Technical support
servi[email protected]
http://www.h3c.com
Documentation feedback
You can e-mail your comments about product documentation to [email protected].
We appreciate your comments.

i
Contents
Configuring MCE ························································································································································· 1
MCE overview ···································································································································································1
MPLS L3VPN overview·············································································································································1
MPLS L3VPN concepts ·············································································································································2
MCE···········································································································································································3
How MCE works ······················································································································································4
Configuring VPN instances on an MCE device·············································································································4
Configuring routing on an MCE device ·························································································································6
Configuration prerequisites ·····································································································································6
Configuring routing between an MCE and a VPN site························································································7
Configuring routing between an MCE and a PE ······························································································· 11
Displaying information about MCE······························································································································ 15
MCE configuration examples ······································································································································· 15
Using OSPF to advertise VPN routes to the PE··································································································· 15
Using BGP to advertise VPN routes to the PE····································································································· 21
Configuring IPv6 MCE···············································································································································26
Overview········································································································································································· 26
Configuring VPN instances on an IPv6 MCE device ································································································· 26
Creating a VPN instance······································································································································ 26
Associating a VPN instance with an interface ··································································································· 26
Configuring route attributes for a VPN instance ································································································ 27
Configuring routing on an IPv6 MCE device·············································································································· 28
Configuring routing between an IPv6 MCE and a VPN site ············································································ 28
Configuring routing between an IPv6 MCE and a PE······················································································· 32
Displaying information about IPv6 MCE ····················································································································· 35
IPv6 MCE configuration example································································································································· 35
Index ···········································································································································································42

1
Configuring MCE
This chapter covers Multi-VPN-Instance CE (MCE) configuration only. For information about routing
protocols, see Layer 3—IP Services Configuration Guide.
MCE overview
MPLS L3VPN overview
MPLS L3VPN is a PE-based L3VPN technology. It uses BGP to advertise VPN routes and uses MPLS to
forward VPN packets over the service provider backbone.
MPLS L3VPN provides flexible networking modes, excellent scalability, and convenient support for MPLS
QoS and MPLS TE.
MPLS L3VPN comprises the following types of devices:
•Customer edge (CE) device—A CE resides at the edge of a customer network and has one or more
interfaces directly connected to a service provider network. It can be a router, a switch, or a host.
It can neither "sense" the presence of any VPN nor does it need to support MPLS.
•Provider edge (PE) device—A PE resides at the edge of a service provider network and connects
one or more CEs. On an MPLS network, all VPN services are processed on the PEs.
•Provider (P) device—A P device is a core device on a service provider network. It is not directly
connected to any CE. It has only basic MPLS forwarding capability.
Figure 1 Network diagram for MPLS L3VPN
CEs and PEs mark the boundary between the service provider network and the customers.
VPN 1
CE
Site 1
VPN 2
CE
CE
CE
Site 3
VPN 2
PE
VPN 1
Site 2
Site 4
PE
PE
PP
PP

2
After a CE establishes an adjacency with a directly connected PE, it advertises its VPN routes to the PE
and learns remote VPN routes from the PE. A CE and a PE can use BGP, an IGP, or static routing to
exchange routing information.
After a PE learns VPN routing information from a CE, it uses BGP to advertise the VPN routing information
to other PEs. A PE maintains routing information for only directly connected VPNs, rather than all VPNs
on the provider network.
A P router maintains only routes to PEs and does not deal with VPN routing information.
When VPN traffic travels over the MPLS backbone, the ingress PE functions as the ingress Label Switching
Router (LSR), the egress PE functions as the egress LSR, and P routers function as the transit LSRs.
MPLS L3VPN concepts
Site
A site has the following features:
•A site is a group of IP systems with IP connectivity that does not rely on any service provider network.
•The classification of a site depends on the topology relationship of the devices, rather than the
geographical positions, though the devices at a site are, in most cases, adjacent to each other
geographically.
•The devices at a site can belong to multiple VPNs, which means a site can belong to multiple VPNs.
•A site is connected to a provider network through one or more CEs. A site can contain many CEs,
but a CE can belong to only one site.
Sites connected to the same provider network can be classified into different sets by policies. Only the
sites in the same set can access each other through the provider network. Such a set is called a VPN.
Address space overlapping
Each VPN independently manages its address space.
The address spaces of VPNs may overlap. For example, if both VPN 1 and VPN 2 use the addresses on
subnet 10.110.10.0/24, address space overlapping occurs.
VPN instance
In MPLS VPN, routes of different VPNs are identified by VPN instance.
A PE creates and maintains a separate VPN instance for each directly connected site. Each VPN instance
contains the VPN membership and routing rules of the corresponding site. If a user at a site belongs to
multiple VPNs at the same time, the VPN instance of the site contains information about all the VPNs.
For independence and security of VPN data, each VPN instance on a PE maintains a routing table and
a label forwarding information base (LFIB). VPN instance information contains the following items: the
LFIB, IP routing table, interfaces bound to the VPN instance, and administration information of the VPN
instance. The administration information of the VPN instance includes the route distinguisher (RD), route
filtering policy, and member interface list.
RD
MPLS L3VPN adds an RD field before an IPv4 address to change the IPv4 address to a VPN-IPv4 address.
PEs use MP-BGP to advertise VPN routes with VPN-IPv4 addresses.
A VPN-IPv4 address consists of 12 bytes. The first eight bytes represent the RD, followed by a four-byte
IPv4 address prefix.

3
Figure 2 VPN-IPv4 address structure
The MCE device does not support advertising VPN routes through MP-BGP. However, to run BGP VPN
instances on the MCE device, you must configure a unique RD for each VPN instance to distinguish
between the VPN instances.
An RD can be in one of the following formats distinguished by a 2-byte Type field:
•When the value of the Type field is 0, the Administrator subfield occupies two bytes, the Assigned
number subfield occupies four bytes, and the RD format is 16 - b i t A S n u m b e r :32-bit user-defined
number. For example, 100:1.
•When the value of the Type field is 1, the Administrator subfield occupies four bytes, the Assigned
number subfield occupies two bytes, and the RD format is 32-bit IPv4 address:16-bit user-defined
number. Fo r e xa m p l e, 172.1.1.1:1.
•When the value of the Type field is 2, the Administrator subfield occupies four bytes, the Assigned
number subfield occupies two bytes, and the RD format is 32-bit AS number:16-bit user-defined
number, where the minimum value of the AS number is 65536. For example, 65536:1.
To guarantee global uniqueness for an RD, do not set the Administrator subfield to any private AS
number or private IP address.
Route target attributes
MPLS L3VPN uses the BGP extended community attributes called route target attributes or route target
attributes, to control the advertisement of VPN routing information.
A VPN instance on a PE supports the following types of route target attributes:
•Export target attribute—A PE sets the export attribute for VPN-IPv4 routes learned from directly
connected sites before advertising them to other PEs.
•Import target attribute—A PE checks the export target attribute of VPN-IPv4 routes received from
other PEs. If the export target attribute matches the import target attribute of the VPN instance, the
PE adds the routes to the VPN routing table.
In other words, route target attributes define which sites can receive a VPN-IPv4 route, and from which
sites that a PE can receive routes.
Similar to RDs, route target attributes can be one of the following formats:
•16 - b i t A S n u m b e r :32-bit user-defined number. For example, 100:1.
•32-bit IPv4 address:16-bit user-defined number. F o r e xa m p l e, 172.1.1.1:1.
•32-bit AS number:16-bit user-defined number, where the minimum value of the AS number is 65536.
For example, 65536:1.
MCE
BGP/MPLS VPN transmits private network data through MPLS tunnels over the public network. However,
the traditional MPLS L3VPN architecture requires each VPN instance use an exclusive CE to connect to a
PE, as shown in Figure 1.

4
For better services and higher security, a private network is usually divided into multiple VPNs to isolate
services. To meet these requirements, you can configure a CE for each VPN, which increases device
expenses and maintenance costs. Or, you can configure multiple VPNs to use the same CE and the same
routing table, which sacrifices data security.
Using the Multi-VPN-Instance CE (MCE) function, you can remove the contradiction of low cost and high
security in multi-VPN networks. MCE allows you to bind each VPN with a VLAN interface. The MCE
creates and maintains a separate routing table for each VPN. This separates the forwarding paths for
packets of different VPNs and, in conjunction with the PE, can correctly advertise the routes of each VPN
to the peer PE, ensuring the normal transmission of VPN packets over the public network.
How MCE works
Figure 3 describes how an MCE maintains the routing tables for multiple VPNs and exchanges VPN
routes with PEs.
Figure 3 Network diagram for the MCE function
On the left-side network, there are two VPN sites, both of which are connected to the MPLS backbone
through the MCE device. VPN 1 and VPN 2 on the left-side network must establish a tunnel with VPN 1
and VPN 2 on the right-side network, respectively.
The MCE creates a routing table for VPN 1 and VPN 2, respectively. VLAN-interface 2 is bound to VPN
1 and VLAN-interface 3 is bound to VPN 2. Upon receiving a route, the MCE determines the source of
the route according to the number of the receiving interface, and adds it to the corresponding routing
table.
You must also bind PE 1' interfaces connected to the MCE to the VPNs in the same way. The MCE
connects to PE 1 through a trunk link, which permits packets of VLAN 2 and VLAN 3 with VLAN tags
carried. In this way, PE 1 can determine the VPN a received packet belongs to according to the VLAN
tag of the packet and sends the packet through the corresponding tunnel.
Configuring VPN instances on an MCE device
Configuring VPN instances is required in all MCE networking schemes.
VPN instances isolate not only VPN routes from public network routes, but also routes among VPNs.

5
Creating a VPN instance
You can configure a description for a VPN instance to record its related information, such as its
relationship with a certain VPN.
To create and configure a VPN instance:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Create a VPN instance and
enter VPN instance view. ip vpn-instance vpn-instance-name
By default, no VPN instance is
created.
3. Configure an RD for the VPN
instance.
route-distinguisher
route-distinguisher
By default, no RD is specified for
the VPN instance.
4. (Optional) Configure a
description for the VPN
instance.
description text By default, no description is
configured for the VPN instance.
NOTE:
To configure BGP for a VPN instance on the MCE, you must configure an RD for the VPN instance.
Associating a VPN instance with an interface
After configuring a VPN instance, you must associate the VPN instance with the interfaces connected to
the VPN site and the PE.
To associate a VPN instance with an interface:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter interface view. interface interface-type
interface-number N/A
3. Associate the current interface
with a VPN instance.
ip binding vpn-instance
vpn-instance-name
By default, no VPN instance is
associated with an interface.
NOTE:
The ip binding vpn-instance command deletes the IP address of the current interface. You must
reconfigure an IP address for the interface after configuring the command.
Configuring route attributes for a VPN instance
The MCE controls VPN route advertisement as follows:
•When a VPN route learned from a site gets redistributed into BGP, BGP associates it with a route
target extended community attribute list, which is usually the export target attribute list of the VPN
instance associated with the site.
•The VPN instance determines which routes it can accept and redistribute according to the
import-extcommunity in the route target.
•The VPN instance determines how to change the route target attributes for routes to be advertised
according to the export-extcommunity in the route target.
To configure route attributes for a VPN instance:

6
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter VPN instance view. ip vpn-instance vpn-instance-name
N/A
3. (Optional) Enter IPv4 VPN
view. ipv4-family N/A
4. Configure route targets for the
VPN instance.
vpn-target vpn-target&<1-8>
[ both | export-extcommunity |
import-extcommunity ]
By default, no route target is
configured for the VPN instance.
5. (Optional.) Configure the
maximum number of routes for
the VPN instance.
routing-table limit number
{ warn-threshold | simply-alert }
By default, the maximum route
number is not configured.
Setting the maximum number of
routes for a VPN instance is for
preventing too many routes from
being redistributed into the PE.
6. (Optional.) Apply a routing
policy to filter incoming routes
for the VPN instance.
import route-policy route-policy
By default, all routes matching the
import target attribute are
accepted.
Make sure the routing policy
already exists. Otherwise, the
device does not filter received
routes.
7. (Optional.) Apply a routing
policy to filter outgoing routes
for the VPN instance.
export route-policy route-policy
By default, no routing policy is
applied to filter the routes to be
advertised.
Make sure the routing policy
already exists. Otherwise, the
device does not filter routes to be
advertised.
NOTE:
•Route related attributes configured in VPN instance view are applicable to both IPv4 VPNs and IPv6
VPNs.
•You can configure route related attributes for IPv4 VPNs in both VPN instance view and IPv4 VPN view.
Those configured in IPv4 VPN view take precedence.
Configuring routing on an MCE device
MCE implements service isolation through route isolation. MCE routing configuration includes:
•MCE-VPN site routing configuration
•MCE-PE routing configuration
Configuration prerequisites
Before you configure routing on an MCE, complete the following tasks:
•Configure VPN instances, and bind the VPN instances with the interfaces connected to the VPN
sites and the PE.

7
•Configure the link layer and network layer protocols on related interfaces to ensure IP connectivity.
Configuring routing between an MCE and a VPN site
Configuring static routing between an MCE and a VPN site
An MCE can reach a VPN site through a static route. Static routing on a traditional CE is globally
effective and thus does not support address overlapping among VPNs. An MCE supports binding a static
route with a VPN instance, so that the static routes of different VPN instances can be isolated from each
other.
To configure a static route to a VPN site:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Configure a static route
for a VPN instance.
ip route-static vpn-instance s-vpn-instance-name
dest-address { mask | mask-length } { next-hop-address
[ public ] [ track track-entry-number ] | interface-type
interface-number [ next-hop-address ] | vpn-instance
d-vpn-instance-name next-hop-address [ track
track-entry-number ] } [ permanent ] [ preference
preference-value ] [ tag tag-value ] [ description
description-text ]
By default, no static
route is configured.
Perform this
configuration on the
MCE. On the VPN
site, configure a
normal static route.
3. (Optional.) Configure
the default preference
for static routes.
ip route-static default-preference
default-preference-value
The default setting is
60.
Configuring RIP between an MCE and a VPN site
A RIP process belongs to the public network or a single VPN instance. If you create a RIP process without
binding it to a VPN instance, the process belongs to the public network. Binding RIP processes to VPN
instances can isolate routes of different VPNs.
To configure RIP between an MCE and a VPN site:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Create a RIP process for a
VPN instance and enter RIP
view.
rip [ process-id ]vpn-instance
vpn-instance-name
Perform this configuration on the
MCE. On the VPN site, create a
normal RIP process.
3. Enable RIP on the interface
attached to the specified
network.
network network-address By default, RIP is disabled on an
interface.
4. Redistribute remote site routes
advertised by the PE.
import-route protocol [process-id ]
[allow-ibgp ] [ cost cost |
route-policy route-policy-name |
tag tag ] *
By default, no route is redistributed
into RIP.
5. (Optional.) Configure the
default cost value for the
redistributed routes.
default cost value If you do not specify a default cost
value, the default cost value is 0.

8
For more information about RIP, see Layer 3—IP Routing Configuration Guide.
Configuring OSPF between an MCE and a VPN site
An OSPF process can belong to a single VPN instance. If you create an OSPF process without binding
it to a VPN instance, the process belongs to the public network.
Binding OSPF processes to VPN instances can isolate routes of different VPNs. An OSPF process can
belong to only one VPN instance, but one VPN instance can use multiple OSPF processes to advertise the
VPN routes.
An OSPF process that is bound with a VPN instance does not use the public network router ID configured
in system view. Therefore, you must configure a router ID when starting the OSPF process.
For more information about OSPF, see Layer 3—IP Routing Configuration Guide.
To configure OSPF between an MCE and a VPN site:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Create an OSPF process for a
VPN instance and enter OSPF
view.
ospf [ process-id | router-id
router-id | vpn-instance
vpn-instance-name ] *
Perform this configuration on the
MCE. On the VPN site, create a
normal OSPF process.
3. (Optional.) Configure the
OSPF domain ID. domain-id domain-id [ secondary ]
The default domain ID is 0.
Perform this configuration only on
the MCE.
The domain ID of an OSPF process
is included in the routes generated
by the process. When an OSPF
route is redistributed into BGP, the
OSPF domain ID is included in the
BGP VPN route and delivered as a
BGP extended community
attribute.
An OSPF process can be
configured with only one domain
ID. Domain IDs of different OSPF
processes are independent of each
other.
All OSPF processes of a VPN must
be configured with the same
domain ID for routes to be correctly
advertised. OSPF processes on PEs
in different VPNs can be
configured with domain IDs as
desired.
4. (Optional.) Configure the type
codes of OSPF extended
community attributes.
ext-community-type { domain-id
type-code1 | router-id type-code2
|route-type type-code3 }
The defaults are as follows:
•0x0005 for Domain ID.
•0x0107 for Router ID.
•0x0306 for Route Type.

9
Ste
p
Command Remarks
5. (Optional.) Configure the
external route tag for
imported VPN routes.
route-tag tag-value
By default, no route tag is
configured.
In some networks, a VPN might be
connected to multiple MCEs.
When one MCE advertise the
routes learned from BGP to the
VPN, the other MCEs might learn
the routes, resulting in routing
loops. To avoid such routing loops,
you can configure route tags for
VPN instances on an MCE. H3C
recommends configuring the same
route tag for the same VPN on the
MCEs.
6. Redistribute remote site routes
advertised by the PE.
import-route protocol [ process-id
| allow-ibgp ] [ cost cost | type
type | tag tag | route-policy
route-policy-name ] *
By default, OSPF does not
redistribute routes from any other
routing protocol.
7. (Optional.) Configure OSPF
to redistribute the default
route.
default-route-advertise summary
cost cost
By default, OSPF does not
redistribute the default route.
This command redistributes the
default route in a Type-3 LSA. The
MCE advertises the default route to
the site.
8. Create an OSPF area and
enter OSPF area view. area area-id By default, no OSPF area is
created.
9. Enable OSPF on the interface
attached to the specified
network in the area.
network ip-address wildcard-mask By default, an interface does not
run OSPF.
Configuring IS-IS between an MCE and a VPN site
An IS-IS process belongs to the public network or a single VPN instance. If you create an IS-IS process
without binding it to a VPN instance, the process belongs to the public network.
Binding IS-IS processes to VPN instances can isolate routes of different VPNs.
To configure IS-IS between an MCE and a VPN site:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Create an IS-IS process for a
VPN instance and enter IS-IS
view.
isis [ process-id ]vpn-instance
vpn-instance-name
Perform this configuration on the
MCE. On the VPN site, configure a
normal IS-IS process.
3. Configure a network entity
title. network-entity net By default, no NET is configured.

10
Ste
p
Command Remarks
4. (Optional.) Redistribute
remote site routes advertised
by the PE.
import-route { isis [ process-id ]|
ospf [ process-id ] | rip
[ process-id ]| bgp [ allow-ibgp ] |
direct | static } [ cost cost |
cost-type { external | internal } |
[ level-1 | level-1-2 | level-2 ] |
route-policy route-policy-name |
tag tag ] *
By default, IS-IS does not
redistribute routes of any other
routing protocol.
If you do not specify the route level
in the command, the command
redistributes routes to the level-2
routing table by default.
5. Return to system view. quit N/A
6. Enter interface view. interface interface-type
interface-number N/A
7. Enable the IS-IS process on
the interface. isis enable [ process-id ] By default, IS-IS is disabled.
For more information about IS-IS, see Layer 3—IP Routing Configuration Guide.
Configuring EBGP between an MCE and a VPN site
To use EBGP for exchanging routing information between an MCE and VPN sites, you must configure a
BGP peer for each VPN instance on the MCE, and redistribute the IGP routes of each VPN instance on
the VPN sites.
1. Configure the MCE:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter BGP view. bgp as-number N/A
3. Enter BGP-VPN instance
view.
ip vpn-instance
vpn-instance-name N/A
4. Specify an EBGP peer or
peer group.
peer { group-name |ip-address }
[ as-number as-number ]
By default, no BGP peer or peer
group is specified.
5. Create and enter BGP-VPN
IPv4 unicast instance view. ipv4-family [unicast ]N/A
6. Enable exchange of IPv4
unicast routes with the
specified peer or peer
group.
peer { group-name |ip-address }
enable
BGP cannot exchange IPv4
unicast routes with any peer or
peer group.
7. Allow routing loops: allow
the local AS number to
appear in the AS_PATH
attribute of routes received
from the peer or peer group
and specify the maximum
appearance times.
peer { group-name |ip-address }
allow-as-loop [ number ]
By default, the local AS number
is not allowed to appear in the
AS_PATH attribute of routes from
a peer or peer group.
8. Redistribute remote site
routes advertised by the PE.
import-route protocol
[ process-id | all-processes ]
By default, BGP does not
redistribute routes from any other
routing protocol.

11
Ste
p
Command Remarks
9. (Optional.) Configure a
filtering policy to filter
advertised routes.
filter-policy { acl-number |
prefix-list ip-prefix-name } export
[ direct | isis process-id | ospf
process-id | rip process-id |
static ]
By default, BGP does not filter
advertised routes.
10. (Optional.) Configure a
filtering policy to filter
received routes.
filter-policy { acl-number |
prefix-list ip-prefix-name } import
By default, BGP does not filter
received routes.
BGP checks routing loops by examining AS numbers. When EBGP is used, the MCE advertises
routing information carrying the local AS number to the site and then receives routing updates from
the site. The routing updates carry the AS number of the MCE, so the MCE discards them to avoid
routing loops. To enable the MCE to receive such routes, configure the MCE to allow routing loops.
Routes redistributed from OSPF to BGP on the MCE have their OSPF attributes removed. To enable
BGP to distinguish routes redistributed from different OSPF domains, you must enable the
redistributed routes to carry the OSPF domain ID by configuring the domain-id command in OSPF
view. The domain ID is added to BGP VPN routes as an extended community attribute.
BGP runs in a BGP VPN instance in the same way as it runs in a normal network. For more
information about BGP, see Layer 3—IP Routing Configuration Guide.
2. Configure the VPN site:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enable BGP and enter BGP
view. bgp as-number By default, BGP is disabled.
3. Create and enter BGP-VPN
IPv4 unicast instance view. ipv4-family [unicast ]N/A
4. Enable BGP to exchange
IPv4 unicast routing
information with the
specified peer or peer
group.
peer { group-name |ip-address }
enable
By default, BGP does not
exchange IPv4 unicast routing
information with any peer or
peer group.
5. Redistribute the IGP routes
of the VPN.
import-route protocol
[ process-id ] [ med med-value |
route-policy route-policy-name ]
*
By default, BGP does not
redistribute any IGP routes.
A VPN site must advertise the
VPN network addresses it can
reach to the connected MCE.
Configuring routing between an MCE and a PE
MCE-PE routing configuration includes these tasks:
•Bind the MCE-PE interfaces to VPN instances
•Perform route configurations
•Redistribute VPN routes into the routing protocol running between the MCE and the PE.
Configurations in this section are performed on the MCE. For information about configuring the PE, see
the configuration guide for the PE.

12
Configuring static routing between an MCE and a PE
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Configure a static route
for a VPN instance.
ip route-static vpn-instance s-vpn-instance-name
dest-address { mask | mask-length } { next-hop-address
[ public ] [ track track-entry-number ] | interface-type
interface-number [ next-hop-address ] | vpn-instance
d-vpn-instance-name next-hop-address [ track
track-entry-number ] } [ permanent ] [ preference
preference-value ] [ tag tag-value ] [ description
description-text ]
By default, no static
route is configured.
3. (Optional.) Configure
the default preference for
static routes.
ip route-static default-preference
default-preference-value
The default setting
is 60.
Configuring RIP between an MCE and a PE
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Create a RIP process for
a VPN instance and
enter RIP view.
rip [ process-id ]vpn-instance
vpn-instance-name N/A
3. Enable RIP on the
interface attached to
the specified network.
network network-address By default, RIP is disabled on
an interface.
4. Redistribute the VPN
routes.
import-route protocol [process-id ]
[allow-ibgp ] [ cost cost | route-policy
route-policy-name | tag tag ] *
By default, no route of any
other routing protocol is
redistributed into RIP.
5. (Optional.) Configure
the default cost value
for the redistributed
routes.
default cost value If you do not specify a default
cost, the default cost is 0.
For more information about RIP, see Layer 3—IP Routing Configuration Guide.
Configuring OSPF between an MCE and a PE
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Create an OSPF process for a
VPN instance and enter OSPF
view.
ospf [ process-id | router-id
router-id | vpn-instance
vpn-instance-name ] *
N/A
3. Disable routing loop
detection. vpn-instance-capability simple
Routing loop detection is enabled.
You must disable routing loop
detection for a VPN OSPF process
on the MCE. Otherwise, the MCE
cannot receive OSPF routes from
the PE.

13
Ste
p
Command Remarks
4. (Optional.) Configure the
OSPF domain ID. domain-id domain-id [ secondary ]
By default, the domain ID is 0.
5. (Optional.) Configure the type
codes of OSPF extended
community attributes.
ext-community-type { domain-id
type-code1 | router-id type-code2
|route-type type-code3 }
The defaults are as follows:
•0x0005 for Domain ID.
•0x0107 for Router ID.
•0x0306 for Route Type.
6. (Optional.) Configure the
external route tag for
imported VPN routes.
route-tag tag-value
By default, no route tag is
configured.
In some networks, a VPN might be
connected to multiple MCEs.
When one MCE advertise the
routes learned from BGP to the
VPN, the other MCEs might learn
the routes, resulting in routing
loops. To avoid such routing loops,
you can configure route tags for
VPN instances on an MCE. H3C
recommends configuring the same
route tag for the same VPN on the
MCEs.
7. Redistribute the VPN routes.
import-route protocol [ process-id
| allow-ibgp ] [ cost cost | type
type | tag tag | route-policy
route-policy-name ] *
By default, no route of any other
routing protocol is redistributed
into OSPF.
8. (Optional.) Configure OSPF
to redistribute the default
route.
default-route-advertise summary
cost cost
By default, OSPF does not
redistribute the default route.
This command redistributes the
default route in a Type-3 LSA. The
MCE advertises the default route to
the PE.
9. (Optional.) Configure a
filtering policy to filter the
redistributed routes.
filter-policy { acl-number [ gateway
ip-prefix-name ] | gateway
ip-prefix-name | ip-prefix
ip-prefix-name [ gateway
ip-prefix-name ] | route-policy
route-policy-name } import
By default, redistributed routes are
not filtered.
10. (Optional.) Configure the
default parameters for
redistributed routes.
default { cost cost | tag tag | type
type } *
The default cost is 1, the default tag
is 1, and the default type is Type-2.
11. Create an OSPF area and
enter OSPF area view. area area-id By default, no OSPF area is
created.
12. Enable OSPF on the interface
attached to the specified
network in the area.
network ip-address wildcard-mask
Required
By default, an interface does not
run OSPF.
For more information about OSPF, see Layer 3—IP Routing Configuration Guide.