HP FlexFabric 5700 User manual

HPE FlexFabric 5700 Switch Series
MCE Configuration Guide
Part number: 5998-8586R
Software version: Release 2422P01 and later
Document version: 6W100-20160331

© Copyright 2016 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
Configuring MCE·····························································································1
MPLS L3VPN overview······································································································································1
Basic MPLS L3VPN architecture ···············································································································1
MPLS L3VPN concepts······························································································································1
MCE overview····················································································································································3
MCE configuration task list ································································································································4
Configuring VPN instances································································································································4
Creating a VPN instance····························································································································4
Associating a VPN instance with an interface····························································································5
Configuring route related attributes for a VPN instance·············································································5
Configuring routing on an MCE··························································································································6
Configuring routing between an MCE and a VPN site···············································································6
Configuring routing between an MCE and a PE ······················································································11
Displaying and maintaining MCE·····················································································································14
MCE configuration examples···························································································································15
Configuring the MCE that uses OSPF to advertise VPN routes to the PE···············································15
Configuring the MCE that uses EBGP to advertise VPN routes to the PE ··············································21
Configuring IPv6 MCE ··················································································25
Overview··························································································································································25
IPv6 MCE configuration task list ······················································································································25
Configuring VPN instances······························································································································25
Creating a VPN instance··························································································································25
Associating a VPN instance with an interface··························································································26
Configuring route related attributes for a VPN instance···········································································26
Configuring routing on an MCE························································································································27
Configuring routing between an MCE and a VPN site·············································································27
Configuring routing between an MCE and a PE ······················································································32
Displaying and maintaining IPv6 MCE·············································································································35
IPv6 MCE configuration example·····················································································································35
Document conventions and icons·································································43
Conventions·····················································································································································43
Network topology icons····································································································································44
Support and other resources ········································································45
Accessing Hewlett Packard Enterprise Support ······························································································45
Accessing updates···········································································································································45
Websites ··················································································································································46
Customer self repair·································································································································46
Remote support········································································································································46
Documentation feedback ·························································································································46
Index·············································································································48

1
Configuring MCE
This chapter describes MCE configuration. For information about the related routing protocols, see
Layer 3
— IP Routing Configuration Guide.
MPLS L3VPN overview
MPLS L3VPN is a L3VPN technology used to interconnect geographically dispersed VPN sites.
MPLS L3VPN uses BGP to advertise VPN routes and uses MPLS to forward VPN packets over a
service provider backbone.
MPLS L3VPN provides flexible networking modes, excellent scalability, and convenient support for
MPLS QoS and MPLS TE.
Basic MPLS L3VPN architecture
Figure 1 Basic MPLS L3VPN architecture
A basic MPLS L3VPN architecture has the following types of devices:
•Customer edge device—ACE device resides on a customer network and has one or more
interfaces directly connected to a service provider network. It does not support VPN or MPLS.
•Provider edge device—APE device resides at the edge of a service provider network and
connects to one or more CEs. All MPLS VPN services are processed on PEs.
•Provider device—A P device is a core device on a service provider network. It is not directly
connected to any CE. A P device has only basic MPLS forwarding capability and does not
handle VPN routing information.
MPLS L3VPN concepts
Site
A site has the following features:
VPN 1
CE
Site 1
VPN 2
CE
CE
CE
Site 3
VPN 2
PE
VPN 1
Site 2
Site 4
PE
PE
PP
PP

2
•A site is a group of IP systems with IP connectivity that does not rely on any service provider
network.
•The classification of a site depends on the topology relationship of the devices, rather than the
geographical positions. However, the devices at a site are, in most cases, adjacent to each
other geographically.
•The devices at a site can belong to multiple VPNs, which means that a site can belong to
multiple VPNs.
•A site is connected to a provider network through one or more CEs. A site can contain multiple
CEs, but a CE can belong to only one site.
Sites connected to the same provider network can be classified into different sets by policies. Only
the sites in the same set can access each other through the provider network. Such a set is called a
VPN.
VPN instance
VPN instances, also calledvirtual routing and forwarding (VRF) instances, implement route isolation,
data independence, and data security for VPNs.
A VPN instance has the following components:
•A separate Label Forwarding Information Base (LFIB).
•An IP routing table.
•Interfaces bound to the VPN instance.
•VPN instance administration information, including route distinguishers (RDs), route targets
(RTs), and route filtering policies.
To associate a site with a VPN instance, bind the VPN instance to the PE's interface connected to the
site. A site can be associated with only one VPN instance, and different sites can associate with the
same VPN instance.AVPN instance contains the VPN membership and routing rules of associated
sites.
VPN-IPv4 address
Each VPN independently manages its address space. The address spaces of VPNs might overlap.
For example, if both VPN 1 and VPN 2 use the addresses on subnet 10.110.10.0/24, address space
overlapping occurs.
BGP cannot process overlapping VPN address spaces. For example, if both VPN 1 and VPN 2 use
the subnet 10.110.10.0/24 and each advertise a route destined for the subnet, BGPselects only one
of them. This results in the loss of the other route.
Multiprotocol BGP (MP-BGP) can solve this problem by advertising VPN-IPv4 addresses (also
called VPNv4 addresses).
Figure 2 VPN-IPv4 address structure
As shown in Figure 2, a VPN-IPv4 address consists of 12 bytes. The first eight bytes represent the
RD, followed by a four-byte IPv4 prefix. The RD and the IPv4 prefix form a unique VPN-IPv4 prefix.
An RD can be in one of the following formats:
•When the Type field is 0, the Administrator subfield occupies two bytes, theAssigned number
subfield occupies four bytes, and the RD format is 16-bit AS number:32-bit user-defined
number. For example, 100:1.
Type
2 bytes 4 bytes
IPv4 address prefix
6 bytes
Route Distinguisher (8 bytes)
Assigned number subfieldAdministrator subfield

3
•When the Type field is 1, the Administrator subfield occupies four bytes, theAssigned number
subfield occupies two bytes, and the RD format is 32-bit IPv4 address:16-bit user-defined
number. For example, 172.1.1.1:1.
•When the Type field is 2, the Administrator subfield occupies four bytes, theAssigned number
subfield occupies two bytes, andthe RD format is 32-bit AS number:16-bit user-defined number,
where the minimum value of theAS number is 65536. For example, 65536:1.
To guarantee global uniqueness for a VPN-IPv4 address, do not set the Administrator subfield to any
private AS number or private IP address.
Route target attribute
MPLS L3VPN uses route target community attributes to control the advertisement of VPN routing
information. A VPN instance on a PE supports the following types of route target attributes:
•Export target attribute—A PE sets the export target attribute for VPN-IPv4 routes learned
from directly connected sites before advertising them to other PEs.
•Import target attribute—APE checks the export target attribute of VPN-IPv4 routes received
from other PEs. If the export target attribute matches the import target attribute of a VPN
instance, the PE adds the routes to the routing table of the VPN instance.
Route target attributes define which sites can receive VPN-IPv4 routes, and from which sites a PE
can receive routes.
Like RDs, route target attributes can be one of the following formats:
•16-bit AS number:32-bit user-defined number. For example, 100:1.
•32-bit IPv4 address:16-bit user-defined number. For example, 172.1.1.1:1.
•32-bit AS number:16-bit user-defined number, where the minimum value of theAS number is
65536. For example, 65536:1.
MCE overview
The Multi-VPN-Instance CE (MCE) feature allows you to create multiple VPN instances on a CE.
The VPN instances each have an independent routing table and an address space to achieve
service isolation.
Figure 3 Network diagram for the MCE function

4
As shown in Figure 3, the MCE exchanges private routes with VPN sites and PE 1, and adds the
private routes to the routing tables of corresponding VPN instances.
•Route exchange between MCE and VPN site—Create VPN instances VPN 1 and VPN 2 on
the MCE. Bind VLAN-interface 2 to VPN 1, and VLAN-interface 3 to VPN 2. The MCE adds a
received route to the routing table of the VPN instance that is bound to the receiving VLAN
interface.
•Route exchange between MCE and PE—The MCE connects to PE 1 through a trunk link that
permits VLAN 2 and VLAN 3. On PE 1, create VPN instances VPN 1 and VPN 2. Bind
VLAN-interface 2 to VPN 1, and VLAN-interface 3 to VPN 2. The MCE and PE add a received
route to the routing table of the VPN instance that is bound to the receiving VLAN interface.
You can configure static routes, RIP, OSPF, IS-IS, EBGP, or IBGP between an MCE and a VPN site
and between an MCE and a PE.
NOTE:
To implement dynamic IP assignment for DHCP clients in private networks, you can configure
DHCP server or DHCP relay agent on the MCE. When the MCE functions as the DHCP server, the
IP addresses assigned to different private networks cannot overlap.
MCE configuration task list
Tasks at a glance
Configuring VPN instances:
1. (Required.) Creating a VPN instance
2. (Required.) Associating a VPN instance with an interface
3. (Optional.) Configuring route related attributes for a VPN instance
Configuring routing on an MCE:
•(Required.) Configuring routing between an MCE and a VPN site
•(Required.) Configuring routing between an MCE and a PE
Configuring VPN instances
VPN instances isolate VPN routes from public network routes and routes among VPNs. You must
configure VPN instances for an MCE network.
Creating a VPN instance
AVPN instance is a collection of the VPN membership and routing rules of its associated site. AVPN
instance may not correspond to one VPN.
To create and configure a VPN instance:
Step Command Remarks
1. Enter system view. system-view N/A
2. Create a VPN instance and
enter VPN instance view. ip vpn-instance
vpn-instance-name By default, no VPN instance is
created.
3. Configure an RD for the VPN
instance. route-distinguisher
route-distinguisher By default, no RD is specified for a
VPN instance.

5
Step Command Remarks
4. (Optional.) Configure a
description for the VPN
instance. description text By default, no description is
configured for a VPN instance.
5. (Optional.) Configure a VPN
ID for the VPN instance. vpn-id vpn-id By default, no VPN ID is
configured for a VPN instance.
Associating a VPN instance with an interface
After creating and configuring a VPN instance, associate the VPN instance with the MCE's interface
connected to the site and the interface connected to the PE.
To associate a VPN instance with an interface:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter interface view. interface interface-type
interface-number N/A
3. Associate a VPN instance
with the interface. ip binding vpn-instance
vpn-instance-name
By default, an interface is not
associated with a VPN instance.
The ip binding vpn-instance
command deletes the IP address
of the current interface. You must
re-configure an IP address for the
interface after configuring the
command.
Configuring route related attributes for a VPN instance
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VPN instance
view or IPv4 VPN view.
•Enter VPN instance view:
ip vpn-instance
vpn-instance-name
•Enter IPv4 VPN view:
a. ip vpn-instance
vpn-instance-name
b. address-family ipv4
Configurations made in VPN
instance view apply to both IPv4
VPN and IPv6 VPN.
IPv4 VPN prefers the
configurations in IPv4 VPN view
over the configurations in VPN
instance view.
3. Configure route targets. vpn-target vpn-target&<1-8> [ both |
export-extcommunity |
import-extcommunity ]
By default, no route targets are
configured.
4. Set the maximum
number of active routes
allowed.
routing-table limit number
{ warn-threshold | simply-alert }
By default, the maximum number
of active routes in the VPN
instance is not limited.
Setting the maximum number of
active routes for a VPN instance
can prevent the PE from learning
too many routes.

6
Configuring routing on an MCE
MCE implements service isolation through route isolation. MCE routing configuration includes the
following:
•MCE-VPN site routing configuration.
•MCE-PE routing configuration.
On the PE, do the following:
•Disable routing loop detection to avoid route loss during route calculation.
•Disable route redistribution between routing protocols to save system resources.
Before you configure routing on an MCE, configure VPN instances, and bind the VPN instances to
the interfaces connected to the VPN sites and the PE.
Configuring routing between an MCE and a VPN site
You can configure static routing, RIP, OSPF, IS-IS, EBGP, or IBGPbetween an MCE and a VPN site.
Configuring static routing between an MCE and a VPN site
An MCE can reach a VPN site through a static route. Static routing on a traditional CE is globally
effective and does not support address overlapping among VPNs. An MCE supports binding a static
route to a VPN instance, so that the static routes of different VPN instances can be isolated from
each other.
To configure a static route to a VPN site:
Step Command Remarks
1. Enter system view. system-view N/A
2. Configure a static
route for a VPN
instance.
ip route-static vpn-instance s-vpn-instance-name
dest-address { mask-length | mask } { interface-type
interface-number [ next-hop-address ] |
next-hop-address [ public ] [ track
track-entry-number ] | vpn-instance
d-vpn-instance-name next-hop-address [ track
track-entry-number ] } [ permanent ] [ preference
preference-value ] [ tag tag-value ] [ description
description-text ]
By default, no static
route is configured.
Perform this
configuration on the
MCE. On the VPN
site, configure a
common static route.
3. (Optional.) Configure
the default preference
for static routes. ip route-static default-preference
default-preference-value The default
preference is 60.
Configuring RIP between an MCE and a VPN site
A RIP process belongs to the public network or a single VPN instance. If you create a RIP process
without binding it to a VPN instance, the process belongs to the public network. Binding RIP
processes to VPN instances can isolate routes of different VPNs. For more information about RIP,
see Layer 3—IP Routing Configuration Guide.
To configure RIP between an MCE and a VPN site:

7
Step Command Remarks
1. Enter system view. system-view N/A
2. Create a RIP process for a
VPN instance and enter RIP
view. rip [ process-id ]vpn-instance
vpn-instance-name
Perform this configuration on the
MCE. On a VPN site, create a
common RIP process.
3. Enable RIP on the interface
attached to the specified
network. network network-address By default, RIP is disabled on an
interface.
4. Redistribute remote site
routes advertised by the PE
into RIP.
import-route protocol
[process-id ] [ allow-ibgp ] [ cost
cost | tag tag ] *
By default, no route is
redistributed into RIP.
5. (Optional.) Configure the
default cost value for the
redistributed routes. default cost value The default cost is 0.
Configuring OSPF between an MCE and a VPN site
An OSPF process belongs to the public network or a single VPN instance. If you create an OSPF
process without binding it to a VPN instance, the process belongs to the public network.
Binding OSPF processes to VPN instances can isolate routes of different VPNs. For more
information about OSPF, see Layer 3—IP Routing Configuration Guide.
To configure OSPF between an MCE and a VPN site:
Step Command Remarks
1. Enter system view. system-view N/A
2. Create an OSPF process for
a VPN instance and enter
OSPF view.
ospf [ process-id | router-id
router-id | vpn-instance
vpn-instance-name ] *
Perform this configuration on the
MCE. On a VPN site, create a
common OSPF process.
An OSPF process bound to a VPN
instance does not use the public
network router ID configured in
system view. Therefore, configure
a router ID for the OSPF process.
An OSPF process can belong to
only one VPN instance, but one
VPN instance can use multiple
OSPF processes to advertise
VPN routes.
3. (Optional.) Configure the
OSPF domain ID. domain-id domain-id
[ secondary ]
The default domain ID is 0.
Perform this configuration on the
MCE.
All OSPF processes of the same
VPN must be configured with the
same OSPF domain ID to ensure
correct route advertisement.
4. (Optional.) Configure the
type codes of OSPF
extended community
attributes.
ext-community-type
{ domain-id type-code1 |
router-id type-code2 |route-type
type-code3 }
The defaults are as follows:
•0x0005 for Domain ID.
•0x0107 for Router ID.
•0x0306 for Route Type.
5. (Optional.) Configure the
external route tag for
imported VPN routes. route-tag tag-value
By default, no route tag is
configured.
In some networks, a VPN might
be connected to multiple MCEs.