HP 6125XLG User manual

HP 6125XLG Blade Switch
MCE
Configuration Guide
Part number: 5998-3721
Software version: Release 2306
Document version: 6W100-20130912

Legal and notice information
© Copyright 2013 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or
use of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained
herein.

i
Contents
Configuring MCE ························································································································································· 1
Overview············································································································································································1
MPLS L3VPN overview·············································································································································1
MPLS L3VPN concepts ·············································································································································2
MCE···········································································································································································3
How MCE works ······················································································································································4
Configuring VPN instances on an MCE device·············································································································4
Configuring routing on an MCE device ·························································································································6
Configuration prerequisites ·····································································································································6
Configuring routing between an MCE and a VPN site························································································7
Configuring routing between an MCE and a PE ······························································································· 11
Displaying information about MCE······························································································································ 15
MCE configuration examples ······································································································································· 15
Using OSPF to advertise VPN routes to the PE··································································································· 15
Using BGP to advertise VPN routes to the PE····································································································· 21
Configuring IPv6 MCE···············································································································································26
Overview········································································································································································· 26
Configuring VPN instances on an IPv6 MCE device ································································································· 26
Creating a VPN instance······································································································································ 26
Associating a VPN instance with an interface ··································································································· 26
Configuring route attributes for a VPN instance ································································································ 27
Configuring routing on an IPv6 MCE device·············································································································· 28
Configuring routing between an IPv6 MCE and a VPN site ············································································ 28
Configuring routing between an IPv6 MCE and a PE······················································································· 32
Displaying information about IPv6 MCE ····················································································································· 35
IPv6 MCE configuration example································································································································· 35
Support and other resources ·····································································································································42
Contacting HP ································································································································································ 42
Subscription service ·············································································································································· 42
Related information························································································································································ 42
Documents······························································································································································ 42
Websites································································································································································· 42
Conventions ···································································································································································· 43
Index ···········································································································································································45

1
Configuring MCE
This chapter describes only Multi-VPN-Instance CE (MCE) configuration. For information about routing
protocols, see Layer 3—IP Services Configuration Guide.
Overview
MPLS L3VPN overview
MPLS L3VPN is a PE-based L3VPN technology. It uses BGP to advertise VPN routes and uses MPLS to
forward VPN packets over the service provider backbone.
MPLS L3VPN provides flexible networking modes, excellent scalability, and convenient support for MPLS
QoS and MPLS TE.
MPLS L3VPN comprises the following types of devices:
•Customer edge (CE) device—A CE resides at the edge of a customer network and has one or more
interfaces directly connected to a service provider network. It can be a router, a switch, or a host.
It can neither "sense" the presence of any VPN nor does it need to support MPLS.
•Provider edge (PE) device—A PE resides at the edge of a service provider network and connects
one or more CEs. On an MPLS network, all VPN services are processed on the PEs.
•Provider (P) device—A P device is a core device on a service provider network. It is not directly
connected to any CE. It has only basic MPLS forwarding capability.
Figure 1 Network diagram for MPLS L3VPN
CEs and PEs mark the boundary between the service provider network and the customers.
VPN 1
CE
Site 1
VPN 2
CE
CE
CE
Site 3
VPN 2
PE
VPN 1
Site 2
Site 4
PE
PE
PP
PP

2
After a CE establishes an adjacency with a directly connected PE, it advertises its VPN routes to the PE
and learns remote VPN routes from the PE. A CE and a PE can use BGP, an IGP, or static routing to
exchange routing information.
After a PE learns VPN routing information from a CE, it uses BGP to advertise the VPN routing information
to other PEs. A PE maintains routing information for only directly connected VPNs, rather than all VPNs
on the provider network.
A P router maintains only routes to PEs and does not deal with VPN routing information.
When VPN traffic travels over the MPLS backbone, the ingress PE functions as the ingress Label Switching
Router (LSR), the egress PE functions as the egress LSR, and P routers function as the transit LSRs.
MPLS L3VPN concepts
Site
A site has the following features:
•A site is a group of IP systems with IP connectivity that does not rely on any service provider network.
•The classification of a site depends on the topology relationship of the devices, rather than the
geographical positions, though the devices at a site are, in most cases, adjacent to each other
geographically.
•The devices at a site can belong to multiple VPNs, which means a site can belong to multiple VPNs.
•A site is connected to a provider network through one or more CEs. A site can contain many CEs,
but a CE can belong to only one site.
Sites connected to the same provider network can be classified into different sets by policies. Only the
sites in the same set can access each other through the provider network. Such a set is called a VPN.
Address space overlapping
Each VPN independently manages its address space.
The address spaces of VPNs may overlap. For example, if both VPN 1 and VPN 2 use the addresses on
subnet 10.110.10.0/24, address space overlapping occurs.
VPN instance
In MPLS VPN, routes of different VPNs are identified by VPN instance.
A PE creates and maintains a separate VPN instance for each directly connected site. Each VPN instance
contains the VPN membership and routing rules of the corresponding site. If a user at a site belongs to
multiple VPNs at the same time, the VPN instance of the site contains information about all the VPNs.
For independence and security of VPN data, each VPN instance on a PE maintains a routing table and
a label forwarding information base (LFIB). VPN instance information contains the following items: the
LFIB, IP routing table, interfaces bound to the VPN instance, and administration information for the VPN
instance. The administration information for the VPN instance includes the route distinguisher (RD), route
filtering policy, and member interface list.
RD
MPLS L3VPN adds an RD field before an IPv4 address to change the IPv4 address to a VPN-IPv4 address.
PEs use MP-BGP to advertise VPN routes with VPN-IPv4 addresses.
A VPN-IPv4 address consists of 12 bytes. The first eight bytes represent the RD, followed by a four-byte
IPv4 address prefix.

3
Figure 2 VPN-IPv4 address structure
The MCE device does not support advertising VPN routes through MP-BGP. However, to run BGP VPN
instances on the MCE device, you must configure a unique RD for each VPN instance to distinguish
between the VPN instances.
An RD can be in one of the following formats distinguished by a 2-byte Type field:
•When the value of the Type field is 0, the Administrator subfield occupies two bytes, the Assigned
number subfield occupies four bytes, and the RD format is 16 - b i t A S nu m b e r :32-bit user-defined
number. For example, 100:1.
•When the value of the Type field is 1, the Administrator subfield occupies four bytes, the Assigned
number subfield occupies two bytes, and the RD format is 32-bit IPv4 address:16-bit user-defined
number. F o r ex a m p l e, 172.1.1.1:1.
•When the value of the Type field is 2, the Administrator subfield occupies four bytes, the Assigned
number subfield occupies two bytes, and the RD format is 32-bit AS number:16-bit user-defined
number, where the minimum value of the AS number is 65536. For example, 65536:1.
To guarantee global uniqueness for an RD, do not set the Administrator subfield to any private AS
number or private IP address.
Route target attributes
MPLS L3VPN uses the BGP extended community attributes called route target attributes or route target
attributes, to control the advertisement of VPN routing information.
A VPN instance on a PE supports the following types of route target attributes:
•Export target attribute—A PE sets the export attribute for VPN-IPv4 routes learned from directly
connected sites before advertising them to other PEs.
•Import target attribute—A PE checks the export target attribute of VPN-IPv4 routes received from
other PEs. If the export target attribute matches the import target attribute of the VPN instance, the
PE adds the routes to the VPN routing table.
In other words, route target attributes define which sites can receive a VPN-IPv4 route, and from which
sites that a PE can receive routes.
Similar to RDs, route target attributes can be one of the following formats:
•16 - b i t A S nu m b e r :32-bit user-defined number. For example, 100:1.
•32-bit IPv4 address:16-bit user-defined number. Fo r e xa m p l e , 172.1.1.1:1.
•32-bit AS number:16-bit user-defined number, where the minimum value of the AS number is 65536.
For example, 65536:1.
MCE
BGP/MPLS VPN transmits private network data through MPLS tunnels over the public network. However,
the traditional MPLS L3VPN architecture requires each VPN instance use an exclusive CE to connect to a
PE, as shown in Figure 1.

4
For better services and higher security, a private network is usually divided into multiple VPNs to isolate
services. To meet these requirements, you can configure a CE for each VPN, which increases device
expenses and maintenance costs. Or, you can configure multiple VPNs to use the same CE and the same
routing table, which sacrifices data security.
Using the Multi-VPN-Instance CE (MCE) function, you can remove the contradiction of low cost and high
security in multi-VPN networks. MCE allows you to bind each VPN with a VLAN interface. The MCE
creates and maintains a separate routing table for each VPN. This separates the forwarding paths for
packets of different VPNs and, in conjunction with the PE, can correctly advertise the routes of each VPN
to the peer PE, ensuring the normal transmission of VPN packets over the public network.
How MCE works
Figure 3 describes how an MCE maintains the routing tables for multiple VPNs and exchanges VPN
routes with PEs.
Figure 3 Network diagram for the MCE function
On the left-side network, there are two VPN sites, both of which are connected to the MPLS backbone
through the MCE device. VPN 1 and VPN 2 on the left-side network must establish a tunnel with VPN 1
and VPN 2 on the right-side network.
The MCE creates a routing table for VPN 1 and VPN 2, respectively. VLAN-interface 2 is bound to VPN
1 and VLAN-interface 3 is bound to VPN 2. Upon receiving a route, the MCE determines the source of
the route according to the number of the receiving interface, and adds it to the corresponding routing
table.
You must also bind PE 1' interfaces connected to the MCE to the VPNs in the same way. The MCE
connects to PE 1 through a trunk link, which permits packets of VLAN 2 and VLAN 3 with VLAN tags
carried. In this way, PE 1 can determine the VPN a received packet belongs to according to the VLAN
tag of the packet and sends the packet through the corresponding tunnel.
Configuring VPN instances on an MCE device
Configuring VPN instances is required in all MCE networking schemes.
VPN instances isolate not only VPN routes from public network routes, but also routes among VPNs.

5
Creating a VPN instance
You can configure a description for a VPN instance to record its related information, such as its
relationship with a certain VPN.
To create and configure a VPN instance:
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Create a VPN instance and
enter VPN instance view. ip vpn-instance vpn-instance-name
By default, no VPN instance is
created.
3. Configure an RD for the VPN
instance.
route-distinguisher
route-distinguisher
By default, no RD is specified for
the VPN instance.
4. (Optional.) Configure a
description for the VPN
instance.
description text By default, no description is
configured for the VPN instance.
NOTE:
To configure BGP for a VPN instance on the MCE, you must configure an RD for the VPN instance.
Associating a VPN instance with an interface
After configuring a VPN instance, you must associate the VPN instance with the interfaces connected to
the VPN site and the PE.
To associate a VPN instance with an interface:
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Enter interface view. interface interface-type
interface-number N/A
3. Associate the current interface
with a VPN instance.
ip binding vpn-instance
vpn-instance-name
By default, no VPN instance is
associated with an interface.
NOTE:
The ip binding vpn-instance command deletes the IP address of the current interface. You must
reconfigure an IP address for the interface after configuring the command.
Configuring route attributes for a VPN instance
The MCE controls VPN route advertisement as follows:
1. When a VPN route learned from a site gets redistributed into BGP, BGP associates it with a route
target extended community attribute list, which is usually the export target attribute list of the VPN
instance associated with the site.
2. The VPN instance determines which routes it can accept and redistribute according to the
import-extcommunity in the route target.
3. The VPN instance determines how to change the route target attributes for routes to be advertised
according to the export-extcommunity in the route target.
To configure route attributes for a VPN instance:

6
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Enter VPN instance view. ip vpn-instance vpn-instance-name
N/A
3. (Optional.) Enter IPv4 VPN
view. ipv4-family N/A
4. Configure route targets for the
VPN instance.
vpn-target vpn-target&<1-8>
[ both | export-extcommunity |
import-extcommunity ]
By default, no route target is
configured for the VPN instance.
5. (Optional.) Configure the
maximum number of routes for
the VPN instance.
routing-table limit number
{ warn-threshold | simply-alert }
By default, the maximum route
number is not configured.
Setting the maximum number of
routes for a VPN instance is for
preventing too many routes from
being redistributed into the PE.
6. (Optional.) Apply a routing
policy to filter incoming routes
for the VPN instance.
import route-policy route-policy
By default, all routes matching the
import target attribute are
accepted.
Make sure the routing policy
already exists. Otherwise, the
device does not filter received
routes.
7. (Optional.) Apply a routing
policy to filter outgoing routes
for the VPN instance.
export route-policy route-policy
By default, no routing policy is
applied to filter the routes to be
advertised.
Make sure the routing policy
already exists. Otherwise, the
device does not filter routes to be
advertised.
NOTE:
•Route related attributes configured in VPN instance view are applicable to both IPv4 VPNs and IPv6
VPNs.
•You can configure route related attributes for IPv4 VPNs in both VPN instance view and IPv4 VPN view.
Those configured in IPv4 VPN view take precedence.
Configuring routing on an MCE device
MCE implements service isolation through route isolation. MCE routing configuration includes:
•MCE-VPN site routing configuration.
•MCE-PE routing configuration.
Configuration prerequisites
Before you configure routing on an MCE, complete the following tasks:
•Configuring VPN instances, and binding the VPN instances with the interfaces connected to the
VPN sites and the PE.

7
•Configuring the link layer and network layer protocols on related interfaces to ensure IP
connectivity.
Configuring routing between an MCE and a VPN site
Configuring static routing between an MCE and a VPN site
An MCE can reach a VPN site through a static route. Static routing on a traditional CE is globally
effective and thus does not support address overlapping among VPNs. An MCE supports binding a static
route with a VPN instance, so that the static routes of different VPN instances can be isolated from each
other.
To configure a static route to a VPN site:
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Configure a static route
for a VPN instance.
ip route-static vpn-instance s-vpn-instance-name
dest-address { mask | mask-length }
{ next-hop-address [ public ] [ track
track-entry-number ] | interface-type
interface-number [ next-hop-address ] |
vpn-instance d-vpn-instance-name
next-hop-address [ track track-entry-number ] }
[ permanent ] [ preference preference-value ]
[ tag tag-value ] [ description description-text ]
By default, no static route is
configured.
Perform this configuration
on the MCE. On the VPN
site, configure a normal
static route.
3. (Optional.) Configure
the default preference
for static routes.
ip route-static default-preference
default-preference-value The default setting is 60.
Configuring RIP between an MCE and a VPN site
A RIP process belongs to the public network or a single VPN instance. If you create a RIP process without
binding it to a VPN instance, the process belongs to the public network. Binding RIP processes to VPN
instances can isolate routes of different VPNs.
To configure RIP between an MCE and a VPN site:
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Create a RIP process for a
VPN instance and enter RIP
view.
rip [ process-id ]vpn-instance
vpn-instance-name
Perform this configuration on the
MCE. On the VPN site, create a
normal RIP process.
3. Enable RIP on the interface
attached to the specified
network.
network network-address By default, RIP is disabled on an
interface.
4. Redistribute remote site routes
advertised by the PE.
import-route protocol [process-id ]
[allow-ibgp ] [ cost cost |
route-policy route-policy-name |
tag tag ] *
By default, no route is redistributed
into RIP.

8
Ste
p
Command
Remarks
5. (Optional.) Configure the
default cost value for the
redistributed routes.
default cost value If you do not specify a default cost
value, the default cost value is 0.
For more information about RIP, see Layer 3—IP Routing Configuration Guide.
Configuring OSPF between an MCE and a VPN site
An OSPF process can belong to a single VPN instance. If you create an OSPF process without binding
it to a VPN instance, the process belongs to the public network.
Binding OSPF processes to VPN instances can isolate routes of different VPNs. An OSPF process can
belong to only one VPN instance, but one VPN instance can use multiple OSPF processes to advertise the
VPN routes.
An OSPF process that is bound with a VPN instance does not use the public network router ID configured
in system view. Therefore, you must configure a router ID when starting the OSPF process.
For more information about OSPF, see Layer 3—IP Routing Configuration Guide.
To configure OSPF between an MCE and a VPN site:
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Create an OSPF process for a
VPN instance and enter OSPF
view.
ospf [ process-id | router-id
router-id | vpn-instance
vpn-instance-name ] *
Perform this configuration on the
MCE. On the VPN site, create a
normal OSPF process.
3. (Optional.) Configure the
OSPF domain ID. domain-id domain-id [ secondary ]
The default domain ID is 0.
Perform this configuration only on
the MCE.
The domain ID of an OSPF process
is included in the routes generated
by the process. When an OSPF
route is redistributed into BGP, the
OSPF domain ID is included in the
BGP VPN route and delivered as a
BGP extended community
attribute.
An OSPF process can be
configured with only one domain
ID. Domain IDs of different OSPF
processes are independent of each
other.
All OSPF processes of a VPN must
be configured with the same
domain ID for routes to be correctly
advertised. OSPF processes on PEs
in different VPNs can be
configured with domain IDs as
desired.

9
Ste
p
Command
Remarks
4. (Optional.) Configure the type
codes of OSPF extended
community attributes.
ext-community-type { domain-id
type-code1 | router-id type-code2
|route-type type-code3 }
The defaults are as follows:
•0x0005 for Domain ID.
•0x0107 for Router ID.
•0x0306 for Route Type.
5. (Optional.) Configure the
external route tag for
imported VPN routes.
route-tag tag-value
By default, no route tag is
configured.
In some networks, a VPN might be
connected to multiple MCEs.
When one MCE advertise the
routes learned from BGP to the
VPN, the other MCEs might learn
the routes, resulting in routing
loops. To avoid such routing loops,
you can configure route tags for
VPN instances on an MCE. H3C
recommends configuring the same
route tag for the same VPN on the
MCEs.
6. Redistribute remote site routes
advertised by the PE.
import-route protocol [ process-id
| allow-ibgp ] [ cost cost | type
type | tag tag | route-policy
route-policy-name ] *
By default, OSPF does not
redistribute routes from any other
routing protocol.
7. (Optional.) Configure OSPF
to redistribute the default
route.
default-route-advertise summary
cost cost
By default, OSPF does not
redistribute the default route.
This command redistributes the
default route in a Type-3 LSA. The
MCE advertises the default route to
the site.
8. Create an OSPF area and
enter OSPF area view. area area-id By default, no OSPF area is
created.
9. Enable OSPF on the interface
attached to the specified
network in the area.
network ip-address wildcard-mask By default, an interface does not
run OSPF.
Configuring IS-IS between an MCE and a VPN site
An IS-IS process belongs to the public network or a single VPN instance. If you create an IS-IS process
without binding it to a VPN instance, the process belongs to the public network.
Binding IS-IS processes to VPN instances can isolate routes of different VPNs.
To configure IS-IS between an MCE and a VPN site:
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Create an IS-IS process for a
VPN instance and enter IS-IS
view.
isis [ process-id ]vpn-instance
vpn-instance-name
Perform this configuration on the
MCE. On the VPN site, configure a
normal IS-IS process.
3. Configure a network entity
title. network-entity net By default, no NET is configured.

10
Ste
p
Command
Remarks
4. (Optional.) Redistribute
remote site routes advertised
by the PE.
import-route { isis [ process-id ]|
ospf [ process-id ] | rip
[ process-id ]| bgp [ allow-ibgp ] |
direct | static } [ cost cost |
cost-type { external | internal } |
[ level-1 | level-1-2 | level-2 ] |
route-policy route-policy-name |
tag tag ] *
By default, IS-IS does not
redistribute routes of any other
routing protocol.
If you do not specify the route level
in the command, the command
redistributes routes to the level-2
routing table by default.
5. Return to system view. quit N/A
6. Enter interface view. interface interface-type
interface-number N/A
7. Enable the IS-IS process on
the interface. isis enable [ process-id ] By default, IS-IS is disabled.
For more information about IS-IS, see Layer 3—IP Routing Configuration Guide.
Configuring EBGP between an MCE and a VPN site
To use EBGP for exchanging routing information between an MCE and VPN sites, you must configure a
BGP peer for each VPN instance on the MCE, and redistribute the IGP routes of each VPN instance on
the VPN sites.
1. Configure the MCE:
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Enter BGP view. bgp as-number N/A
3. Enter BGP-VPN instance
view.
ip vpn-instance
vpn-instance-name N/A
4. Specify an EBGP peer or
peer group.
peer { group-name |ip-address }
[ as-number as-number ]
By default, no BGP peer or peer
group is specified.
5. Create and enter BGP-VPN
IPv4 unicast instance view. ipv4-family [unicast ]N/A
6. Enable exchange of IPv4
unicast routes with the
specified peer or peer
group.
peer { group-name |ip-address }
enable
BGP cannot exchange IPv4
unicast routes with any peer or
peer group.
7. Allow routing loops: allow
the local AS number to
appear in the AS_PATH
attribute of routes received
from the peer or peer group
and specify the maximum
appearance times.
peer { group-name |ip-address }
allow-as-loop [ number ]
By default, the local AS number
is not allowed to appear in the
AS_PATH attribute of routes from
a peer or peer group.
8. Redistribute remote site
routes advertised by the PE.
import-route protocol
[ process-id | all-processes ]
By default, BGP does not
redistribute routes from any other
routing protocol.

11
Ste
p
Command
Remarks
9. (Optional.) Configure a
filtering policy to filter
advertised routes.
filter-policy { acl-number |
prefix-list ip-prefix-name } export
[ direct | isis process-id | ospf
process-id | rip process-id |
static ]
By default, BGP does not filter
advertised routes.
10. (Optional.) Configure a
filtering policy to filter
received routes.
filter-policy { acl-number |
prefix-list ip-prefix-name } import
By default, BGP does not filter
received routes.
BGP checks routing loops by examining AS numbers. When EBGP is used, the MCE advertises
routing information carrying the local AS number to the site and then receives routing updates from
the site. The routing updates carry the AS number of the MCE, so the MCE discards them to avoid
routing loops. To enable the MCE to receive such routes, configure the MCE to allow routing loops.
Routes redistributed from OSPF to BGP on the MCE have their OSPF attributes removed. To enable
BGP to distinguish routes redistributed from different OSPF domains, you must enable the
redistributed routes to carry the OSPF domain ID by configuring the domain-id command in OSPF
view. The domain ID is added to BGP VPN routes as an extended community attribute.
BGP runs in a BGP VPN instance in the same way as it runs in a normal network. For more
information about BGP, see Layer 3—IP Routing Configuration Guide.
2. Configure the VPN site:
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Enable BGP and enter BGP
view. bgp as-number By default, BGP is disabled.
3. Create and enter BGP-VPN
IPv4 unicast instance view. ipv4-family [unicast ]N/A
4. Enable BGP to exchange
IPv4 unicast routing
information with the
specified peer or peer
group.
peer { group-name |ip-address }
enable
By default, BGP does not
exchange IPv4 unicast routing
information with any peer or
peer group.
5. Redistribute the IGP routes
of the VPN.
import-route protocol
[ process-id ] [ med med-value |
route-policy route-policy-name ]
*
By default, BGP does not
redistribute any IGP routes.
A VPN site must advertise the
VPN network addresses it can
reach to the connected MCE.
Configuring routing between an MCE and a PE
MCE-PE routing configuration includes these tasks:
•Binding the MCE-PE interfaces to VPN instances.
•Performing route configurations.
•Redistributing VPN routes into the routing protocol running between the MCE and the PE.
Configurations in this section are performed on the MCE. For information about configuring the PE, see
the configuration guide for the PE.

12
Configuring static routing between an MCE and a PE
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Configure a static route
for a VPN instance.
ip route-static vpn-instance
s-vpn-instance-name dest-address { mask |
mask-length } { next-hop-address [ public ]
[ track track-entry-number ] | interface-type
interface-number [ next-hop-address ] |
vpn-instance d-vpn-instance-name
next-hop-address [ track track-entry-number ] }
[ permanent ] [ preference preference-value ]
[ tag tag-value ] [ description description-text ]
By default, no static route is
configured.
3. (Optional.) Configure
the default preference for
static routes.
ip route-static default-preference
default-preference-value The default setting is 60.
Configuring RIP between an MCE and a PE
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Create a RIP process for
a VPN instance and
enter RIP view.
rip [ process-id ]vpn-instance
vpn-instance-name N/A
3. Enable RIP on the
interface attached to
the specified network.
network network-address By default, RIP is disabled on
an interface.
4. Redistribute the VPN
routes.
import-route protocol [process-id ]
[allow-ibgp ] [ cost cost | route-policy
route-policy-name | tag tag ] *
By default, no route of any
other routing protocol is
redistributed into RIP.
5. (Optional.) Configure
the default cost value
for the redistributed
routes.
default cost value If you do not specify a default
cost, the default cost is 0.
For more information about RIP, see Layer 3—IP Routing Configuration Guide.
Configuring OSPF between an MCE and a PE
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Create an OSPF process for a
VPN instance and enter OSPF
view.
ospf [ process-id | router-id
router-id | vpn-instance
vpn-instance-name ] *
N/A
3. Disable routing loop
detection. vpn-instance-capability simple
Routing loop detection is enabled.
You must disable routing loop
detection for a VPN OSPF process
on the MCE. Otherwise, the MCE
cannot receive OSPF routes from
the PE.

13
Ste
p
Command
Remarks
4. (Optional.) Configure the
OSPF domain ID. domain-id domain-id [ secondary ]
By default, the domain ID is 0.
5. (Optional.) Configure the type
codes of OSPF extended
community attributes.
ext-community-type { domain-id
type-code1 | router-id type-code2
|route-type type-code3 }
The defaults are as follows:
•0x0005 for Domain ID.
•0x0107 for Router ID.
•0x0306 for Route Type.
6. (Optional.) Configure the
external route tag for
imported VPN routes.
route-tag tag-value
By default, no route tag is
configured.
In some networks, a VPN might be
connected to multiple MCEs.
When one MCE advertise the
routes learned from BGP to the
VPN, the other MCEs might learn
the routes, resulting in routing
loops. To avoid such routing loops,
you can configure route tags for
VPN instances on an MCE. H3C
recommends configuring the same
route tag for the same VPN on the
MCEs.
7. Redistribute the VPN routes.
import-route protocol [ process-id
| allow-ibgp ] [ cost cost | type
type | tag tag | route-policy
route-policy-name ] *
By default, no route of any other
routing protocol is redistributed
into OSPF.
8. (Optional.) Configure OSPF
to redistribute the default
route.
default-route-advertise summary
cost cost
By default, OSPF does not
redistribute the default route.
This command redistributes the
default route in a Type-3 LSA. The
MCE advertises the default route to
the PE.
9. (Optional.) Configure a
filtering policy to filter the
redistributed routes.
filter-policy { acl-number [ gateway
ip-prefix-name ] | gateway
ip-prefix-name | ip-prefix
ip-prefix-name [ gateway
ip-prefix-name ] | route-policy
route-policy-name } import
By default, redistributed routes are
not filtered.
10. (Optional.) Configure the
default parameters for
redistributed routes.
default { cost cost | tag tag | type
type } *
The default cost is 1, the default tag
is 1, and the default type is Type-2.
11. Create an OSPF area and
enter OSPF area view. area area-id By default, no OSPF area is
created.
12. Enable OSPF on the interface
attached to the specified
network in the area.
network ip-address wildcard-mask
Required
By default, an interface does not
run OSPF.
For more information about OSPF, see Layer 3—IP Routing Configuration Guide.

14
Configuring IS-IS between an MCE and a PE
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Create an IS-IS process
for a VPN instance and
enter IS-IS view.
isis [ process-id ]vpn-instance
vpn-instance-name N/A
3. Configure a network
entity title. network-entity net By default, no NET is configured.
4. (Optional.) Redistribute
the VPN routes.
import-route { isis [ process-id ]|ospf
[ process-id ] | rip [ process-id ]| bgp
[ allow-ibgp ] | direct | static } [ cost cost
| cost-type { external | internal } |
[ level-1 | level-1-2 | level-2 ] |
route-policy route-policy-name |tag
tag ] *
By default, IS-IS does not
redistribute routes of any other
routing protocol.
If you do not specify the route level
in the command, the command
redistributes routes to the level-2
routing table by default.
5. (Optional.) Configure a
filtering policy to filter
the redistributed routes.
filter-policy { acl-number | prefix-list
prefix-list-name | route-policy
route-policy-name } import
By default, IS-IS does not filter
redistributed routes.
6. Return to system view. quit N/A
7. Enter interface view. interface interface-type interface-number
N/A
8. Enable the IS-IS process
on the interface. isis enable [ process-id ] By default, no IS-IS process is
enabled.
For more information about IS-IS, see Layer 3—IP Routing Configuration Guide.
Configuring EBGP between an MCE and a PE
Ste
p
Command
Remarks
1. Enter system view. system-view N/A
2. Enable BGP and enter BGP
view. bgp as-number By default, BGP is not enabled.
3. Enter BGP-VPN instance view. ip vpn-instance vpn-instance-name
N/A
4. Specify the PE as the EBGP
peer.
peer { group-name |ip-address }
[ as-number as-number ]
By default, no BGP peer or peer
group is specified.
5. Create and enter BGP-VPN
IPv4 unicast instance view. ipv4-family [unicast ]N/A
6. Enable BGP to exchange IPv4
unicast routing information
with the specified peer or
peer group.
peer { group-name |ip-address }
enable
By default, BGP does not exchange
IPv4 unicast routing information
with any peer or peer group.
7. Redistribute the VPN routes of
the VPN site.
import-route protocol [ process-id
|all-processes ]
By default, BGP does not
redistribute routes from any other
routing protocol.
8. (Optional.) Configure a
filtering policy to filter the
routes to be advertised.
filter-policy { acl-number |
prefix-list ip-prefix-name } export
[ direct | isis process-id | ospf
process-id | rip process-id | static ]
By default, BGP does not filter the
routes to be advertised.

15
Ste
p
Command
Remarks
9. (Optional.) Configure a
filtering policy to filter the
received routes.
filter-policy { acl-number |
prefix-list ip-prefix-name } import
By default, BGP does not filter the
received routes.
For more information about BGP, see Layer 3—IP Routing Configuration Guide.
Displaying information about MCE
Execute display commands in any view.
Task Command
Display VPN instance information. display ip vpn-instance [ instance-name vpn-instance-name ]
Display BGP peer group
information for a VPN instance. display bgp group ipv4 vpn-instance vpn-instance-name [ group-name ]
Display BGP peer information for a
VPN instance.
display bgp peer ipv4 vpn-instance vpn-instance-name [ group-name
log-info | ip-address { log-info | verbose } | verbose ]
For other MCE related displaying and maintaining commands, such as displaying routing table
information for a VPN instance and maintaining routing sessions for a VPN instance, see Layer 3—IP
Routing Command Reference.
MCE configuration examples
Using OSPF to advertise VPN routes to the PE
Network requirements
As shown in Figure 4, the MCE device is connected to VPN 1 through VLAN-interface 10 and to VPN 2
through VLAN-interface 20. OSPF runs in VPN 2.
Configure the MCE device to separate routes from different VPNs and advertise the VPN routes to PE 1
through OSPF.

16
Figure 4 Network diagram
Configuration procedure
Assume that the system name of the MCE device is MCE, the system names of the edge devices of VPN
1 and VPN 2 are VR1 and VR2, and the system name of PE 1 is PE1.
1. Configure the VPN instances on the MCE and PE 1:
# On the MCE, configure VPN instances vpn1 and vpn2, and specify an RD and route targets for
each VPN instance.
<MCE> system-view
[MCE] ip vpn-instance vpn1
[MCE-vpn-instance-vpn1] route-distinguisher 10:1
[MCE-vpn-instance-vpn1] vpn-target 10:1
[MCE-vpn-instance-vpn1] quit
[MCE] ip vpn-instance vpn2
[MCE-vpn-instance-vpn2] route-distinguisher 20:1
[MCE-vpn-instance-vpn2] vpn-target 20:1
[MCE-vpn-instance-vpn2] quit
# Create VLAN 10, add port Ten-GigabitEthernet 1/0/1 to VLAN 10, and create VLAN-interface
10.
[MCE] vlan 10
[MCE-vlan10] port Ten-GigabitEthernet 1/0/1
[MCE-vlan10] quit
[MCE] interface vlan-interface 10
# Bind VLAN-interface 10 with VPN instance vpn1, and configure an IP address for
VLAN-interface 10.
CE 2
VPN 1
Site 2
CE 1
VPN 2
Site 1
PE 1
PE 3
PE 2
VPN 2
192.168.10.0/24
VR 2
VPN 1
192.168.0.0/24 VR 1
MCE
XGE1/0/1
Vlan-int10
10.214.10.3/24
XGE1/0/1
Vlan-int30: 30.1.1.2/24
Vlan-int40: 40.1.1.2/24
XGE1/0/3
Vlan-int30: 30.1.1.1/24
Vlan-int40: 40.1.1.1/24
XGE1/0/2
Vlan-int20
10.214.20.3/24

17
[MCE-Vlan-interface10] ip binding vpn-instance vpn1
[MCE-Vlan-interface10] ip address 10.214.10.3 24
# Configure VLAN 20, add port Ten-GigabitEthernet 1/0/2 to VLAN 20, bind VLAN-interface 20
with VPN instance vpn2, and specify an IP address for VLAN-interface 20.
[MCE-Vlan-interface10] quit
[MCE] vlan 20
[MCE-vlan20] port Ten-GigabitEthernet 1/0/2
[MCE-vlan20] quit
[MCE] interface vlan-interface 20
[MCE-Vlan-interface20] ip binding vpn-instance vpn2
[MCE-Vlan-interface20] ip address 10.214.20.3 24
[MCE-Vlan-interface20] quit
# On PE 1, configure VPN instances vpn1 and vpn2, and specify an RD and route targets for each
VPN instance.
<PE1> system-view
[PE1] ip vpn-instance vpn1
[PE1-vpn-instance-vpn1] route-distinguisher 30:1
[PE1-vpn-instance-vpn1] vpn-target 10:1
[PE1-vpn-instance-vpn1] quit
[PE1] ip vpn-instance vpn2
[PE1-vpn-instance-vpn2] route-distinguisher 40:1
[PE1-vpn-instance-vpn2] vpn-target 20:1
[PE1-vpn-instance-vpn2] quit
2. Configure routing between the MCE and VPN sites:
The MCE is connected to VPN 1 directly, and no routing protocol is enabled in VPN 1. Therefore,
you can configure static routes.
# On VR 1, assign IP address 10.214.10.2/24 to the interface connected to MCE and
192.168.0.1/24 to the interface connected to VPN 1. Add ports to VLANs correctly. (Details not
shown)
# On VR 1, configure a default route with the next hop as 10.214.10.3.
<VR1> system-view
[VR1] ip route-static 0.0.0.0 0.0.0.0 10.214.10.3
# On the MCE, configure a static route to 192.168.0.0/24, specify the next hop as 10.214.10.2,
and bind the static route with VPN instance vpn1.
[MCE] ip route-static vpn-instance vpn1 192.168.0.0 24 10.214.10.2
# On the MCE, display the routing information maintained for VPN instance vpn1.
[MCE] display ip routing-table vpn-instance vpn1
Destinations : 13 Routes : 13
Destination/Mask Proto Pre Cost NextHop Interface
0.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
10.214.10.0/24 Direct 0 0 10.214.10.3 Vlan10
10.214.10.0/32 Direct 0 0 10.214.10.3 Vlan10
10.214.10.3/32 Direct 0 0 127.0.0.1 InLoop0
10.214.10.255/32 Direct 0 0 10.214.10.3 Vlan10
127.0.0.0/8 Direct 0 0 127.0.0.1 InLoop0