HP FlexFabric 5700 User manual

HPE FlexFabric 5700 Switch Series
MCE Configuration Guide
Part number: 5998-8586R
Software version: Release 2422P01 and later
Document version: 6W100-20160331

© Copyright 2016 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® andAcrobat® are trademarks ofAdobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
Configuring MCE·····························································································1
MPLS L3VPN overview······································································································································1
Basic MPLS L3VPN architecture ···············································································································1
MPLS L3VPN concepts······························································································································1
MCE overview····················································································································································3
MCE configuration task list ································································································································4
Configuring VPN instances································································································································4
Creating a VPN instance····························································································································4
Associating a VPN instance with an interface····························································································5
Configuring route related attributes for a VPN instance·············································································5
Configuring routing on an MCE··························································································································6
Configuring routing between an MCE and a VPN site···············································································6
Configuring routing between an MCE and a PE ······················································································11
Displaying and maintaining MCE·····················································································································14
MCE configuration examples···························································································································15
Configuring the MCE that uses OSPF to advertise VPN routes to the PE···············································15
Configuring the MCE that uses EBGP to advertise VPN routes to the PE ··············································21
Configuring IPv6 MCE ··················································································25
Overview··························································································································································25
IPv6 MCE configuration task list ······················································································································25
Configuring VPN instances······························································································································25
Creating a VPN instance··························································································································25
Associating a VPN instance with an interface··························································································26
Configuring route related attributes for a VPN instance···········································································26
Configuring routing on an MCE························································································································27
Configuring routing between an MCE and a VPN site·············································································27
Configuring routing between an MCE and a PE ······················································································32
Displaying and maintaining IPv6 MCE·············································································································35
IPv6 MCE configuration example·····················································································································35
Document conventions and icons·································································43
Conventions·····················································································································································43
Network topology icons····································································································································44
Support and other resources ········································································45
Accessing Hewlett Packard Enterprise Support ······························································································45
Accessing updates···········································································································································45
Websites ··················································································································································46
Customer self repair·································································································································46
Remote support········································································································································46
Documentation feedback ·························································································································46
Index·············································································································48

1
Configuring MCE
This chapter describes MCE configuration. For information about the related routing protocols, see
Layer 3
— IP Routing Configuration Guide.
MPLS L3VPN overview
MPLS L3VPN is a L3VPN technology used to interconnect geographically dispersed VPN sites.
MPLS L3VPN uses BGP to advertise VPN routes and uses MPLS to forward VPN packets over a
service provider backbone.
MPLS L3VPN provides flexible networking modes, excellent scalability, and convenient support for
MPLS QoS and MPLS TE.
Basic MPLS L3VPN architecture
Figure 1 Basic MPLS L3VPN architecture
A basic MPLS L3VPN architecture has the following types of devices:
•Customer edge device—ACE device resides on a customer network and has one or more
interfaces directly connected to a service provider network. It does not support VPN or MPLS.
•Provider edge device—APE device resides at the edge of a service provider network and
connects to one or more CEs. All MPLS VPN services are processed on PEs.
•Provider device—A P device is a core device on a service provider network. It is not directly
connected to any CE. A P device has only basic MPLS forwarding capability and does not
handle VPN routing information.
MPLS L3VPN concepts
Site
A site has the following features:
VPN 1
CE
Site 1
VPN 2
CE
CE
CE
Site 3
VPN 2
PE
VPN 1
Site 2
Site 4
PE
PE
PP
PP

2
•A site is a group of IP systems with IP connectivity that does not rely on any service provider
network.
•The classification of a site depends on the topology relationship of the devices, rather than the
geographical positions. However, the devices at a site are, in most cases, adjacent to each
other geographically.
•The devices at a site can belong to multiple VPNs, which means that a site can belong to
multiple VPNs.
•A site is connected to a provider network through one or more CEs. A site can contain multiple
CEs, but a CE can belong to only one site.
Sites connected to the same provider network can be classified into different sets by policies. Only
the sites in the same set can access each other through the provider network. Such a set is called a
VPN.
VPN instance
VPN instances, also calledvirtual routing and forwarding (VRF) instances, implement route isolation,
data independence, and data security for VPNs.
A VPN instance has the following components:
•A separate Label Forwarding Information Base (LFIB).
•An IP routing table.
•Interfaces bound to the VPN instance.
•VPN instance administration information, including route distinguishers (RDs), route targets
(RTs), and route filtering policies.
To associate a site with a VPN instance, bind the VPN instance to the PE's interface connected to the
site. A site can be associated with only one VPN instance, and different sites can associate with the
same VPN instance.AVPN instance contains the VPN membership and routing rules of associated
sites.
VPN-IPv4 address
Each VPN independently manages its address space. The address spaces of VPNs might overlap.
For example, if both VPN 1 and VPN 2 use the addresses on subnet 10.110.10.0/24, address space
overlapping occurs.
BGP cannot process overlapping VPN address spaces. For example, if both VPN 1 and VPN 2 use
the subnet 10.110.10.0/24 and each advertise a route destined for the subnet, BGPselects only one
of them. This results in the loss of the other route.
Multiprotocol BGP (MP-BGP) can solve this problem by advertising VPN-IPv4 addresses (also
called VPNv4 addresses).
Figure 2 VPN-IPv4 address structure
As shown in Figure 2, a VPN-IPv4 address consists of 12 bytes. The first eight bytes represent the
RD, followed by a four-byte IPv4 prefix. The RD and the IPv4 prefix form a unique VPN-IPv4 prefix.
An RD can be in one of the following formats:
•When the Type field is 0, the Administrator subfield occupies two bytes, theAssigned number
subfield occupies four bytes, and the RD format is 16-bit AS number:32-bit user-defined
number. For example, 100:1.
Type
2 bytes 4 bytes
IPv4 address prefix
6 bytes
Route Distinguisher (8 bytes)
Assigned number subfieldAdministrator subfield

3
•When the Type field is 1, the Administrator subfield occupies four bytes, theAssigned number
subfield occupies two bytes, and the RD format is 32-bit IPv4 address:16-bit user-defined
number. For example, 172.1.1.1:1.
•When the Type field is 2, the Administrator subfield occupies four bytes, theAssigned number
subfield occupies two bytes, andthe RD format is 32-bit AS number:16-bit user-defined number,
where the minimum value of theAS number is 65536. For example, 65536:1.
To guarantee global uniqueness for a VPN-IPv4 address, do not set the Administrator subfield to any
private AS number or private IP address.
Route target attribute
MPLS L3VPN uses route target community attributes to control the advertisement of VPN routing
information. A VPN instance on a PE supports the following types of route target attributes:
•Export target attribute—A PE sets the export target attribute for VPN-IPv4 routes learned
from directly connected sites before advertising them to other PEs.
•Import target attribute—APE checks the export target attribute of VPN-IPv4 routes received
from other PEs. If the export target attribute matches the import target attribute of a VPN
instance, the PE adds the routes to the routing table of the VPN instance.
Route target attributes define which sites can receive VPN-IPv4 routes, and from which sites a PE
can receive routes.
Like RDs, route target attributes can be one of the following formats:
•16-bit AS number:32-bit user-defined number. For example, 100:1.
•32-bit IPv4 address:16-bit user-defined number. For example, 172.1.1.1:1.
•32-bit AS number:16-bit user-defined number, where the minimum value of theAS number is
65536. For example, 65536:1.
MCE overview
The Multi-VPN-Instance CE (MCE) feature allows you to create multiple VPN instances on a CE.
The VPN instances each have an independent routing table and an address space to achieve
service isolation.
Figure 3 Network diagram for the MCE function

4
As shown in Figure 3, the MCE exchanges private routes with VPN sites and PE 1, and adds the
private routes to the routing tables of corresponding VPN instances.
•Route exchange between MCE and VPN site—Create VPN instances VPN 1 and VPN 2 on
the MCE. Bind VLAN-interface 2 to VPN 1, and VLAN-interface 3 to VPN 2. The MCE adds a
received route to the routing table of the VPN instance that is bound to the receiving VLAN
interface.
•Route exchange between MCE and PE—The MCE connects to PE 1 through a trunk link that
permits VLAN 2 and VLAN 3. On PE 1, create VPN instances VPN 1 and VPN 2. Bind
VLAN-interface 2 to VPN 1, and VLAN-interface 3 to VPN 2. The MCE and PE add a received
route to the routing table of the VPN instance that is bound to the receiving VLAN interface.
You can configure static routes, RIP, OSPF, IS-IS, EBGP, or IBGP between an MCE and a VPN site
and between an MCE and a PE.
NOTE:
To implement dynamic IP assignment for DHCP clients in private networks, you can configure
DHCP server or DHCP relay agent on the MCE. When the MCE functions as the DHCP server, the
IP addresses assigned to different private networks cannot overlap.
MCE configuration task list
Tasks at a glance
Configuring VPN instances:
1. (Required.) Creating a VPN instance
2. (Required.) Associating a VPN instance with an interface
3. (Optional.) Configuring route related attributes for a VPN instance
Configuring routing on an MCE:
•(Required.) Configuring routing between an MCE and a VPN site
•(Required.) Configuring routing between an MCE and a PE
Configuring VPN instances
VPN instances isolate VPN routes from public network routes and routes among VPNs. You must
configure VPN instances for an MCE network.
Creating a VPN instance
AVPN instance is a collection of the VPN membership and routing rules of its associated site. AVPN
instance may not correspond to one VPN.
To create and configure a VPN instance:
Step Command Remarks
1. Enter system view. system-view N/A
2. Create a VPN instance and
enter VPN instance view. ip vpn-instance
vpn-instance-name By default, no VPN instance is
created.
3. Configure an RD for the VPN
instance. route-distinguisher
route-distinguisher By default, no RD is specified for a
VPN instance.

5
Step Command Remarks
4. (Optional.) Configure a
description for the VPN
instance. description text By default, no description is
configured for a VPN instance.
5. (Optional.) Configure a VPN
ID for the VPN instance. vpn-id vpn-id By default, no VPN ID is
configured for a VPN instance.
Associating a VPN instance with an interface
After creating and configuring a VPN instance, associate the VPN instance with the MCE's interface
connected to the site and the interface connected to the PE.
To associate a VPN instance with an interface:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter interface view. interface interface-type
interface-number N/A
3. Associate a VPN instance
with the interface. ip binding vpn-instance
vpn-instance-name
By default, an interface is not
associated with a VPN instance.
The ip binding vpn-instance
command deletes the IP address
of the current interface. You must
re-configure an IP address for the
interface after configuring the
command.
Configuring route related attributes for a VPN instance
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter VPN instance
view or IPv4 VPN view.
•Enter VPN instance view:
ip vpn-instance
vpn-instance-name
•Enter IPv4 VPN view:
a. ip vpn-instance
vpn-instance-name
b. address-family ipv4
Configurations made in VPN
instance view apply to both IPv4
VPN and IPv6 VPN.
IPv4 VPN prefers the
configurations in IPv4 VPN view
over the configurations in VPN
instance view.
3. Configure route targets. vpn-target vpn-target&<1-8> [ both |
export-extcommunity |
import-extcommunity ]
By default, no route targets are
configured.
4. Set the maximum
number of active routes
allowed.
routing-table limit number
{ warn-threshold | simply-alert }
By default, the maximum number
of active routes in the VPN
instance is not limited.
Setting the maximum number of
active routes for a VPN instance
can prevent the PE from learning
too many routes.

6
Configuring routing on an MCE
MCE implements service isolation through route isolation. MCE routing configuration includes the
following:
•MCE-VPN site routing configuration.
•MCE-PE routing configuration.
On the PE, do the following:
•Disable routing loop detection to avoid route loss during route calculation.
•Disable route redistribution between routing protocols to save system resources.
Before you configure routing on an MCE, configure VPN instances, and bind the VPN instances to
the interfaces connected to the VPN sites and the PE.
Configuring routing between an MCE and a VPN site
You can configure static routing, RIP, OSPF, IS-IS, EBGP, or IBGPbetween an MCE and a VPN site.
Configuring static routing between an MCE and a VPN site
An MCE can reach a VPN site through a static route. Static routing on a traditional CE is globally
effective and does not support address overlapping among VPNs. An MCE supports binding a static
route to a VPN instance, so that the static routes of different VPN instances can be isolated from
each other.
To configure a static route to a VPN site:
Step Command Remarks
1. Enter system view. system-view N/A
2. Configure a static
route for a VPN
instance.
ip route-static vpn-instance s-vpn-instance-name
dest-address { mask-length | mask } { interface-type
interface-number [ next-hop-address ] |
next-hop-address [ public ] [ track
track-entry-number ] | vpn-instance
d-vpn-instance-name next-hop-address [ track
track-entry-number ] } [ permanent ] [ preference
preference-value ] [ tag tag-value ] [ description
description-text ]
By default, no static
route is configured.
Perform this
configuration on the
MCE. On the VPN
site, configure a
common static route.
3. (Optional.) Configure
the default preference
for static routes. ip route-static default-preference
default-preference-value The default
preference is 60.
Configuring RIP between an MCE and a VPN site
A RIP process belongs to the public network or a single VPN instance. If you create a RIP process
without binding it to a VPN instance, the process belongs to the public network. Binding RIP
processes to VPN instances can isolate routes of different VPNs. For more information about RIP,
see Layer 3—IP Routing Configuration Guide.
To configure RIP between an MCE and a VPN site:

7
Step Command Remarks
1. Enter system view. system-view N/A
2. Create a RIP process for a
VPN instance and enter RIP
view. rip [ process-id ]vpn-instance
vpn-instance-name
Perform this configuration on the
MCE. On a VPN site, create a
common RIP process.
3. Enable RIP on the interface
attached to the specified
network. network network-address By default, RIP is disabled on an
interface.
4. Redistribute remote site
routes advertised by the PE
into RIP.
import-route protocol
[process-id ] [ allow-ibgp ] [ cost
cost | tag tag ] *
By default, no route is
redistributed into RIP.
5. (Optional.) Configure the
default cost value for the
redistributed routes. default cost value The default cost is 0.
Configuring OSPF between an MCE and a VPN site
An OSPF process belongs to the public network or a single VPN instance. If you create an OSPF
process without binding it to a VPN instance, the process belongs to the public network.
Binding OSPF processes to VPN instances can isolate routes of different VPNs. For more
information about OSPF, see Layer 3—IP Routing Configuration Guide.
To configure OSPF between an MCE and a VPN site:
Step Command Remarks
1. Enter system view. system-view N/A
2. Create an OSPF process for
a VPN instance and enter
OSPF view.
ospf [ process-id | router-id
router-id | vpn-instance
vpn-instance-name ] *
Perform this configuration on the
MCE. On a VPN site, create a
common OSPF process.
An OSPF process bound to a VPN
instance does not use the public
network router ID configured in
system view. Therefore, configure
a router ID for the OSPF process.
An OSPF process can belong to
only one VPN instance, but one
VPN instance can use multiple
OSPF processes to advertise
VPN routes.
3. (Optional.) Configure the
OSPF domain ID. domain-id domain-id
[ secondary ]
The default domain ID is 0.
Perform this configuration on the
MCE.
All OSPF processes of the same
VPN must be configured with the
same OSPF domain ID to ensure
correct route advertisement.
4. (Optional.) Configure the
type codes of OSPF
extended community
attributes.
ext-community-type
{ domain-id type-code1 |
router-id type-code2 |route-type
type-code3 }
The defaults are as follows:
•0x0005 for Domain ID.
•0x0107 for Router ID.
•0x0306 for Route Type.
5. (Optional.) Configure the
external route tag for
imported VPN routes. route-tag tag-value
By default, no route tag is
configured.
In some networks, a VPN might
be connected to multiple MCEs.

8
Step Command Remarks
When one MCE advertises the
routes learned from BGP to the
VPN, the other MCEs might learn
the routes, resulting in routing
loops. To avoid such routing
loops, you can configure route
tags for VPN instances on an
MCE. As a best practice,
configure the same route tag for
the same VPN on the MCEs.
6. Redistribute remote site
routes advertised by the PE
into OSPF.
import-route protocol
[ process-id |all-processes |
allow-ibgp ] [ cost cost |
nssa-only | tag tag | type type ] *
By default, no routes are
redistributed into OSPF.
7. (Optional.) Configure OSPF
to redistribute the default
route. default-route-advertise
summary cost cost
By default, OSPF does not
redistribute the default route.
This command redistributes the
default route in a Type-3 LSA. The
MCE advertises the default route
to the site.
8. Create an OSPF area and
enter OSPF area view. area area-id By default, no OSPF area is
created.
9. Enable OSPF on the
interface attached to the
specified network in the area.
network ip-address
wildcard-mask
By default, an interface neither
belongs to any area nor runs
OSPF.
Configuring IS-IS between an MCE and a VPN site
An IS-IS process belongs to the public network or a single VPN instance. If you create an IS-IS
process without binding it to a VPN instance, the process belongs to the public network.
Binding IS-IS processes to VPN instances can isolate routes of different VPNs. For more information
about IS-IS, see Layer 3—IP Routing Configuration Guide.
To configure IS-IS between an MCE and a VPN site:
Step Command Remarks
1. Enter system view. system-view N/A
2. Create an IS-IS process for a
VPN instance and enter
IS-IS view. isis [ process-id ]vpn-instance
vpn-instance-name
Perform this configuration on the
MCE. On a VPN site, configure a
common IS-IS process.
3. Configure a network entity
title. network-entity net By default, no NET is configured.
4. Redistribute remote site
routes advertised by the PE
into IS-IS.
import-route protocol
[ process-id | all-processes |
allow-ibgp ] [ cost cost |
cost-type { external | internal } |
[ level-1 | level-1-2 | level-2 ] | tag
tag ] *
By default, IS-IS does not
redistribute routes from any other
routing protocol.
If you do not specify the route
level in the command, the
command redistributes routes to
the level-2 routing table by
default.
5. Return to system view. quit N/A
6. Enter interface view. interface interface-type
interface-number N/A

9
Step Command Remarks
7. Enable the IS-IS process on
the interface. isis enable [ process-id ] By default, IS-IS is disabled.
Configuring EBGP between an MCE and a VPN site
To run EBGP between an MCE and a VPN site, you must configure a BGP peer for each VPN
instance on the MCE, and redistribute the IGP routes of each VPN instance on the VPN site.
You can configure filtering policies to filter received routes and advertised routes.
1. Configure the MCE:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter BGP view. bgp as-number N/A
3. Enter BGP-VPN instance
view. ip vpn-instance
vpn-instance-name N/A
4. Configure an EBGP peer. peer { group-name |ip-address
[ mask-length ] } as-number
as-number
By default, no BGP peer is
configured.
5. Enter BGP-VPN IPv4
unicast address family
view. address-family ipv4 [unicast ]N/A
6. Enable BGP to exchange
IPv4 unicast routes with
the peer. peer { group-name |ip-address
[ mask-length ] } enable
By default, BGP does not
exchange IPv4 unicast routes
with any peer.
7. Allow the local AS
number to appear in the
AS_PATH attribute of
routes received from the
peer, and set the
maximum number of
repetitions.
peer { group-name |ip-address
[ mask-length ] } allow-as-loop
[ number ]
By default, BGP discards
incoming route updates that
contain the local AS number.
8. Redistribute remote site
routes advertised by the
PE into BGP.
import-route protocol [ { process-id
|all-processes } [ med
med-value ] ]
By default, no routes are
redistributed into BGP.
9. (Optional.) Configure
filtering of advertised
routes. filter-policy acl-number export
[ protocol process-id ] By default, BGP does not filter advertised routes.
10. (Optional.) Configure
filtering of received
routes. filter-policy acl-number import By default, BGP does not
filter received routes.
2. Configure a VPN site:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter BGP view. bgp as-number N/A
3. Configure the MCE as an
EBGP peer. peer { group-name |ip-address
[ mask-length ] } as-number
as-number N/A

10
Step Command Remarks
4. Enter BGP IPv4 unicast
address family view. address-family ipv4 [unicast ]N/A
5. Enable BGP to exchange
IPv4 unicast routes with the
peer. peer { group-name |ip-address
[ mask-length ] } enable
By default, BGP does not
exchange IPv4 unicast routes
with any peer.
6. Redistribute the IGP routes
of the VPN into BGP. import-route protocol
[ { process-id | all-processes }
[med med-value ] ]
By default, no routes are
redistributed into BGP.
A VPN site must advertise the
VPN network addresses it can
reach to the connected MCE.
Configuring IBGP between MCE and VPN site
To run IBGP between an MCE and a VPN site, you must configure a BGP peer for each VPN
instance on the MCE, and redistribute the IGP routes of each VPN instance on the VPN site.
1. Configure the MCE:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter BGP view. bgp as-number N/A
3. Enter BGP-VPN instance
view. ip vpn-instance
vpn-instance-name N/A
4. Configure an IBGP peer. peer { group-name |ip-address
[ mask-length ] } as-number
as-number N/A
5. Enter BGP-VPN IPv4
unicast address family
view. address-family ipv4 [unicast ]N/A
6. Enable BGP to exchange
IPv4 unicast routes with the
peer. peer { group-name |ip-address
[ mask-length ] } enable
By default, BGP does not
exchange IPv4 unicast routes
with any peer.
7. (Optional.) Configure the
system to be the RR, and
specify the peer as the
client of the RR.
peer { group-name | ip-address
[ mask-length ] } reflect-client
By default, no RR or RR client is
configured.
After you configure a VPN site
as an IBGP peer, the MCE does
not advertise the BGP routes
learned from the VPN site to
other IBGP peers, including
VPNv4 peers. The MCE
advertises routes learned from a
VPN site only when you
configure the VPN site as a
client of the RR (the MCE).
8. Redistribute remote site
routes advertised by the
PE into BGP.
import-route protocol
[ { process-id | all-processes }
[ med med-value ] ]
By default, no routes are
redistributed into BGP.
9. (Optional.) Configure
filtering of advertised
routes. filter-policy acl-number export
[ protocol process-id ] By default, BGP does not filter advertised routes.
10. (Optional.) Configure
filtering of received routes. filter-policy acl-number import
By default, BGP does not filter
received routes.

11
2. Configure a VPN site:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter BGP view. bgp as-number N/A
3. Configure the MCE as an
IBGP peer. peer { group-name |ip-address
[ mask-length ] } as-number
as-number N/A
4. Enter BGP IPv4 unicast
address family view. address-family ipv4 [unicast ]N/A
5. Enable BGP to exchange
IPv4 unicast routes with the
peer. peer { group-name |ip-address
[ mask-length ] } enable
By default, BGP does not
exchange IPv4 unicast routes
with any peer.
6. Redistribute the IGP routes
of the VPN into BGP. import-route protocol
[ { process-id | all-processes }
[med med-value ] ]
By default, no routes are
redistributed into BGP.
A VPN site must advertise VPN
network addresses to the
connected MCE.
Configuring routing between an MCE and a PE
MCE-PE routing configuration includes the following tasks:
•Binding the MCE-PE interfaces to VPN instances.
•Performing route configurations.
•Redistributing VPN routes into the routing protocol running between the MCE and the PE.
Perform the following configurations on the MCE. Configure the PE in the same way that you
configure a PE in a basic MPLS L3VPN. For more information about configuring the PE, see
"Configuring MPLS L3VPN."
Configuring static routing between an MCE and a PE
Step Command Remarks
1. Enter system view. system-view N/A
2. Configure a static route
for a VPN instance.
ip route-static vpn-instance
s-vpn-instance-name dest-address { mask-length
| mask } { interface-type interface-number
[ next-hop-address ] | next-hop-address [ public ]
[ track track-entry-number ] | vpn-instance
d-vpn-instance-name next-hop-address [ track
track-entry-number ] } [ permanent ] [ preference
preference-value ] [ tag tag-value ] [ description
description-text ]
By default, no static
route is configured.
3. (Optional.) Configure
the default preference
for static routes.
ip route-static default-preference
default-preference-value The default preference
is 60.

12
Configuring RIP between an MCE and a PE
Step Command Remarks
1. Enter system view. system-view N/A
2. Create a RIP process
for a VPN instance and
enter RIP view. rip [ process-id ]vpn-instance
vpn-instance-name N/A
3. Enable RIP on the
interface attached to
the specified network. network network-address By default, RIP is disabled on
an interface.
4. Redistribute the VPN
routes. import-route protocol [ process-id |
all-processes | allow-ibgp ] [ cost cost | tag
tag ] *
By default, no routes are
redistributed into RIP.
5. (Optional.) Configure
the default cost for
redistributed routes. default cost value The default cost is 0.
Configuring OSPF between an MCE and a PE
Step Command Remarks
1. Enter system view. system-view N/A
2. Create an OSPF process for
a VPN instance and enter
OSPF view.
ospf [ process-id | router-id
router-id | vpn-instance
vpn-instance-name ] * N/A
3. Disable routing loop
detection. vpn-instance-capability simple
By default, routing loop detection
is enabled.
You must disable routing loop
detection for an OSPF VRF
process on the MCE. Otherwise,
the MCE does not receive OSPF
routes from the PE.
4. (Optional.) Configure the
OSPF domain ID. domain-id domain-id
[ secondary ] The default domain ID is 0.
5. (Optional.) Configure the
type codes of OSPF
extended community
attributes.
ext-community-type
{ domain-id type-code1 |
router-id type-code2 |route-type
type-code3 }
The defaults are as follows:
•0x0005 for Domain ID.
•0x0107 for Router ID.
•0x0306 for Route Type.
6. (Optional.) Configure the
external route tag for
imported VPN routes. route-tag tag-value
By default, no route tag is
configured.
In some networks, a VPN might
be connected to multiple MCEs.
When one MCE advertises the
routes learned from BGP to the
VPN, the other MCEs might learn
the routes, resulting in routing
loops. To avoid such routing
loops, you can configure route
tags for VPN instances on an
MCE. As a best practice,
configure the same route tag for
the same VPN on the MCEs.
7. Redistribute the VPN routes. import-route protocol
[ process-id |all-processes |
allow-ibgp ] [ cost cost |
By default, no routes are
redistributed into OSPF.

13
Step Command Remarks
nssa-only | tag tag | type type ] *
8. (Optional.) Configure OSPF
to redistribute the default
route. default-route-advertise
summary cost cost
By default, OSPF does not
redistribute the default route.
This command redistributes the
default route in a Type-3 LSA. The
MCE advertises the default route
to the PE.
9. (Optional.) Configure filtering
of advertised routes. filter-policy acl-number export
[protocol [ process-id ] ]
By default, redistributed routes
are not filtered.
10. (Optional.) Configure the
default parameters for
redistributed routes (cost,
route number, tag, and type).
default { cost cost | tag tag | type
type } *
The default cost is 1, the default
tag is 1, and default type of
redistributed routes is Type-2.
11. Create an OSPF area and
enter OSPF area view. area area-id By default, no OSPF area is
created.
12. Enable OSPF on the
interface attached to the
specified network in the area. network ip-address
wildcard-mask
By default, an interface neither
belongs to any area nor runs
OSPF.
Configuring IS-IS between an MCE and a PE
Step Command Remarks
1. Enter system view. system-view N/A
2. Create an IS-IS
process for a VPN
instance and enter
IS-IS view.
isis [ process-id ] vpn-instance
vpn-instance-name N/A
3. Configure a network
entity title. network-entity net By default, no NET is configured.
4. Redistribute VPN
routes.
import-route protocol [ process-id |
all-processes |allow-ibgp ] [ cost cost
| cost-type { external | internal } |
[ level-1 | level-1-2 | level-2 ] | tag tag ]
*
By default, IS-IS does not
redistribute routes from any other
routing protocol.
If you do not specify the route level
in the command, the command
redistributes routes to the level-2
routing table by default.
5. (Optional.) Configure
filtering of advertised
routes. filter-policy acl-number export
[protocol [ process-id ] ] By default, IS-IS does not filter advertised routes.
6. Return to system view. quit N/A
7. Enter interface view. interface interface-type
interface-number N/A
8. Enable the IS-IS
process on the
interface. isis enable [ process-id ] By default, no IS-IS process is
enabled.
Configuring EBGP between an MCE and a PE
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter BGP view. bgp as-number N/A

14
Step Command Remarks
3. Enter BGP-VPN
instance view. ip vpn-instance vpn-instance-name N/A
4. Configure the PE as an
EBGP peer. peer { group-name |ip-address
[ mask-length ] } as-number as-number N/A
5. Enter BGP-VPN IPv4
unicast address family
view. address-family ipv4 [unicast ]N/A
6. Enable BGP to
exchange IPv4 unicast
routes with the peer. peer { group-name |ip-address
[ mask-length ] } enable
By default, BGP does not
exchange IPv4 unicast routes
with any peer.
7. Redistribute the VPN
routes of the VPN site. import-route protocol [ { process-id |
all-processes } [ med med-value ] ] By default, no routes are
redistributed into BGP.
8. (Optional.) Configure
filtering of advertised
routes. filter-policy acl-number export [ protocol
process-id ] By default, BGP does not filter advertised routes.
9. (Optional.) Configure
filtering of received
routes. filter-policy acl-number import By default, BGP does not filter
received routes.
Configuring IBGP between an MCE and a PE
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter BGP view. bgp as-number N/A
3. Enter BGP-VPN
instance view. ip vpn-instance vpn-instance-name N/A
4. Configure the PE as an
IBGP peer. peer { group-name |ip-address
[ mask-length ] } as-number as-number N/A
5. Enter BGP-VPN IPv4
unicast address family
view. address-family ipv4 [unicast ]N/A
6. Enable BGP to
exchange IPv4 unicast
routes with the peer. peer { group-name |ip-address
[ mask-length ] } enable
By default, BGP does not
exchange IPv4 unicast routes
with any peer.
7. Redistribute the VPN
routes of the VPN site. import-route protocol [ { process-id |
all-processes } [ med med-value ] ] By default, no routes are
redistributed into BGP.
8. (Optional.) Configure
filtering of advertised
routes. filter-policy acl-number export [ protocol
process-id ] By default, BGP does not filter
advertised routes.
9. (Optional.) Configure
filtering of received
routes. filter-policy acl-number import By default, BGP does not filter
received routes.
Displaying and maintaining MCE
Execute display commands in any view.

15
Task Command
Display information about a specified or
all VPN instances. display ip vpn-instance [ instance-name vpn-instance-name ]
Display BGP peer group information for
a VPN instance. display bgp group ipv4 [ unicast ] vpn-instance
vpn-instance-name [ group-name group-name ]
Display BGP peer information for a VPN
instance.
display bgp peer ipv4 [ unicast ] vpn-instance
vpn-instance-name [ ip-address mask-length | { ip-address |
group-name group-name } log-info | [ [ ip-address ] verbose ]
[ standby slot slot-number ] ]
For other MCE related displaying and maintaining commands, such as displaying routing table
information for a VPN instance and maintaining routing sessions for a VPN instance, see Layer
3—IP Routing Command Reference.
For more information about the display bgp group and display bgp peer commands, see Layer
3—IP Routing Command Reference.
MCE configuration examples
Configuring the MCE that uses OSPF to advertise VPN
routes to the PE
Network requirements
As shown in Figure 4, VPN 2 runs OSPF. Configure the MCE device to separate routes from different
VPNs and to advertise the VPN routes to PE 1 through OSPF.

16
Figure 4 Network diagram
Configuration procedure
Assume that the system name of the MCE device is MCE, the system names of the edge devices of
VPN 1 and VPN 2 are VR1 and VR2, respectively, and the system name of PE 1 is PE1.
1. Configure the VPN instances on the MCE and PE 1:
# On the MCE, configure VPN instances vpn1 and vpn2, and specify an RD and route targets
for each VPN instance.
<MCE> system-view
[MCE] ip vpn-instance vpn1
[MCE-vpn-instance-vpn1] route-distinguisher 10:1
[MCE-vpn-instance-vpn1] vpn-target 10:1
[MCE-vpn-instance-vpn1] quit
[MCE] ip vpn-instance vpn2
[MCE-vpn-instance-vpn2] route-distinguisher 20:1
[MCE-vpn-instance-vpn2] vpn-target 20:1
[MCE-vpn-instance-vpn2] quit
# Create VLAN 10, add port Ten-GigabitEthernet 1/0/1 to VLAN 10.
[MCE] vlan 10
[MCE-vlan10] port ten-gigabitethernet 1/0/1
[MCE-vlan10] quit
# Create VLAN-interface 10, and bind VLAN-interface 10 to VPN instance vpn1.
[MCE] interface vlan-interface 10
[MCE-Vlan-interface10] ip binding vpn-instance vpn1
# Configure an IP address for VLAN-interface 10.
[MCE-Vlan-interface10] ip address 10.214.10.3 24

17
[MCE-Vlan-interface10] quit
# Configure VLAN 20, add port Ten-GigabitEthernet 1/0/2 to VLAN 20.
[MCE] vlan 20
[MCE-vlan20] port ten-gigabitethernet 1/0/2
[MCE-vlan20] quit
# Bind VLAN-interface 20 to VPN instance vpn2.
[MCE] interface vlan-interface 20
[MCE-Vlan-interface20] ip binding vpn-instance vpn2
# Specify an IP address for VLAN-interface 20.
[MCE-Vlan-interface20] ip address 10.214.20.3 24
[MCE-Vlan-interface20] quit
# On PE 1, configure VPN instances vpn1 and vpn2, and specify an RD and route targets for
each VPN instance.
<PE1> system-view
[PE1] ip vpn-instance vpn1
[PE1-vpn-instance-vpn1] route-distinguisher 10:1
[PE1-vpn-instance-vpn1] vpn-target 10:1
[PE1-vpn-instance-vpn1] quit
[PE1] ip vpn-instance vpn2
[PE1-vpn-instance-vpn2] route-distinguisher 20:1
[PE1-vpn-instance-vpn2] vpn-target 20:1
[PE1-vpn-instance-vpn2] quit
2. Configure routing between the MCE and VPN sites:
The MCE is connected to VPN 1 directly, and no routing protocol is enabled in VPN 1.
Therefore, you can configure static routes.
# On VR 1, assign IP address 10.214.10.2/24 to the interface connected to MCE and
192.168.0.1/24 to the interface connected to VPN 1. Add ports to VLANs correctly. (Details not
shown.)
# On VR 1, configure a default route with the next hop being 10.214.10.3.
<VR1> system-view
[VR1] ip route-static 0.0.0.0 0.0.0.0 10.214.10.3
# On the MCE, configure a static route to 192.168.0.0/24 with the next hop 10.214.10.2. Bind
the static route to VPN instance vpn1.
[MCE] ip route-static vpn-instance vpn1 192.168.0.0 24 10.214.10.2
# On the MCE, display the routing information maintained for VPN instance vpn1.
[MCE] display ip routing-table vpn-instance vpn1
Destinations : 13 Routes : 13
Destination/Mask Proto Pre Cost NextHop Interface
0.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
10.214.10.0/24 Direct 0 0 10.214.10.3 Vlan10
10.214.10.0/32 Direct 0 0 10.214.10.3 Vlan10
10.214.10.3/32 Direct 0 0 127.0.0.1 InLoop0
10.214.10.255/32 Direct 0 0 10.214.10.3 Vlan10
127.0.0.0/8 Direct 0 0 127.0.0.1 InLoop0
127.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
127.0.0.1/32 Direct 0 0 127.0.0.1 InLoop0