This article details the configuration that is required on SRX devices that are acting as Provider Edge (PE), Customer Edge (CE), and Provider Router (P) devices to get L3VPN over MPLS with the help of an example.
Topology
PE-1 Configuration
Configure interfaces:
PE interface (interface connecting to P-router)
set interfaces ge-0/0/14 unit 0 family inet address 192.168.1.1/30 set interfaces ge-0/0/14 unit 0 family mpls
CE interface (interface connecting to CE devices)
set interfaces ge-0/0/15 unit 0 family inet address 10.10.10.1/30
Loopback
set interfaces lo0 unit 0 family inet address 172.16.1.1/32
Enable routing protocols:
OSPF between PE to P (we can use BGP as well).
set protocols ospf traffic-engineering set protocols ospf area 0.0.0.0 interface lo0.0 passive set protocols ospf area 0.0.0.0 interface ge-0/0/14.0
BGP as signaling protocol
set routing-options autonomous-system 65432 set protocols bgp group mplsvpn type internal set protocols bgp group mplsvpn local-address 172.16.1.1 set protocols bgp group mplsvpn family inet-vpn unicast set protocols bgp group mplsvpn family l2vpn signaling set protocols bgp group mplsvpn neighbor 172.16.2.1
Enable MPLS and RSVP:
set protocols rsvp interface ge-0/0/14.0 set protocols mpls label-switched-path To-Site-B to 172.16.2.1 set protocols mpls label-switched-path To-Site-B install 172.16.2.1/32 set protocols mpls interface ge-0/0/14.0
Create an L3VPN instance:
set routing-instances Site-A instance-type vrf set routing-instances Site-A interface ge-0/0/15.0 set routing-instances Site-A route-distinguisher 172.16.1.1:100 set routing-instances Site-A vrf-target target:172.16.1.1:100 set routing-instances Site-A vrf-table-label set routing-instances Site-A protocols bgp group To-CE-1 type external set routing-instances Site-A protocols bgp group To-CE-1 family inet unicast set routing-instances Site-A protocols bgp group To-CE-1 export To-LAN-A set routing-instances Site-A protocols bgp group To-CE-1 peer-as 65431 set routing-instances Site-A protocols bgp group To-CE-1 local-as 65433 set routing-instances Site-A protocols bgp group To-CE-1 neighbor 10.10.10.2
Below policy is to advertise routes received from PE-2 to CE-1.
set policy-options policy-statement To-CE-1 term 1 from route-filter 10.10.200.0/30 exact set policy-options policy-statement To-CE-1 term 1 then accept
Enable packet-mode processing.
set security forwarding-options family mpls mode packet-based
Note: PE-1 and PE-2 are in packet mode. To get this working in flow mode, you need to apply the following firewall filters on ge-0/0/14 (input direction) on both SRX/PE devices.
set firewall family mpls filter For-MPLS term 1 then packet-mode
CE-1 Configuration
set interfaces ge-0/0/15 unit 0 family inet address 10.10.10.2/30 > Towards PE set interfaces ge-0/0/4 unit 0 family inet address 10.10.100.1/30 > Towards LAN
Configure BGP with PE-1:
set routing-options autonomous-system 65431 set protocols bgp group LAN-A type external set protocols bgp group LAN-A family inet unicast set protocols bgp group LAN-A export To-PE-1 set protocols bgp group LAN-A peer-as 65433 set protocols bgp group LAN-A local-as 65431 set protocols bgp group LAN-A neighbor 10.10.10.1
Below policy is to advertise LAN side routes to PE-1.
set policy-options policy-statement To-PE-1 term 1 from route-filter 10.10.100.0/30 exact set policy-options policy-statement To-PE-1 term 1 then accept
We need the exact same configuration on PE-2 and CE-2.
PE-2 Configuration
set interfaces ge-0/0/13 unit 0 family inet address 10.10.20.1/30 set interfaces ge-0/0/14 unit 0 family inet address 192.168.2.1/30 set interfaces ge-0/0/14 unit 0 family mpls set interfaces lo0 unit 0 family inet address 172.16.2.1/32 set protocols rsvp interface ge-0/0/14.0 set protocols mpls label-switched-path To-Site-A to 172.16.1.1 set protocols mpls label-switched-path To-Site-A install 172.16.1.1/32 set protocols mpls interface ge-0/0/14.0 set routing-options autonomous-system 65432 set protocols bgp group mplsvpn type internal set protocols bgp group mplsvpn local-address 172.16.2.1 set protocols bgp group mplsvpn family inet-vpn unicast set protocols bgp group mplsvpn family l2vpn signaling set protocols bgp group mplsvpn neighbor 172.16.1.1 set protocols ospf traffic-engineering set protocols ospf area 0.0.0.0 interface ge-0/0/14.0 set protocols ospf area 0.0.0.0 interface lo0.0 passive set instance-type vrf set interface ge-0/0/13.0 set route-distinguisher 172.16.2.1:100 set vrf-target target:172.16.1.1:100 set vrf-table-label set protocols bgp group To-CE-2 type external set protocols bgp group To-CE-2 family inet unicast set protocols bgp group To-CE-2 export To-LAN-B set protocols bgp group To-CE-2 peer-as 65421 set protocols bgp group To-CE-2 local-as 65422 set protocols bgp group To-CE-2 neighbor 10.10.20.2 set policy-options policy-statement To-CE-2 term 1 from route-filter 10.10.100.0/30 exact set policy-options policy-statement To-CE-2 term 1 then accept
CE-2 Configuration
set interfaces ge-0/0/13 unit 0 family inet address 10.10.20.2/30 set interfaces ge-0/0/4 unit 1 family inet address 10.10.200.1/30 set routing-options autonomous-system 65421 set protocols bgp group LAN-B type external set protocols bgp group LAN-B family inet unicast set protocols bgp group LAN-B export To-PE-2 set protocols bgp group LAN-B peer-as 65422 set protocols bgp group LAN-B local-as 65421 set protocols bgp group LAN-B neighbor 10.10.20.1 set policy-options policy-statement To-PE-2 from route-filter 10.10.200.0/30 exact set policy-options policy-statement To-PE-2 then accept
P_router Configuration
set interfaces ge-0/0/1 unit 0 family inet address 192.168.1.2/30 set interfaces ge-0/0/1 unit 0 family mpls set interfaces ge-0/0/4 unit 0 family inet address 192.168.2.2/30 set interfaces ge-0/0/4 unit 0 family mpls set protocols rsvp interface ge-0/0/1.0 set protocols rsvp interface ge-0/0/4.0 set protocols mpls interface ge-0/0/1.0 set protocols mpls interface ge-0/0/4.0 set protocols ospf area 0.0.0.0 interface ge-0/0/1.0 set protocols ospf area 0.0.0.0 interface ge-0/0/4.0
Verification
Make sure that the LSP is up between PE-1 and PE-2.
root@PE-1> show mpls lsp Ingress LSP: 1 sessions To From State Rt P ActivePath LSPname 172.16.2.1 172.16.1.1 Up 0 * To-Site-B Total 1 displayed, Up 1, Down 0 Egress LSP: 1 sessions To From State Rt Style Labelin Labelout LSPname 172.16.1.1 172.16.2.1 Up 0 1 FF 3 - To-Site-A Total 1 displayed, Up 1, Down 0 Transit LSP: 0 sessions Total 0 displayed, Up 0, Down 0
Check the BGP peering between PE-1 and PE-2.
root@PE-1> show bgp summary Groups: 2 Peers: 2 Down peers: 0 Table Tot Paths Act Paths Suppressed History Damp State Pending bgp.l3vpn.0 2 2 0 0 0 0 bgp.l2vpn.0 0 0 0 0 0 0 Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped... 10.10.10.2 65431 111 112 0 0 48:36 Establ Site-A.inet.0: 1/1/1/0 172.16.2.1 65432 593 601 0 0 4:24:58 Establ bgp.l3vpn.0: 2/2/2/0 bgp.l2vpn.0: 0/0/0/0 Site-A.inet.0: 2/2/2/0
Check the LSP status on P_router.
root@P_router> show mpls lsp statistics Ingress LSP: 0 sessions Total 0 displayed, Up 0, Down 0 Egress LSP: 0 sessions Total 0 displayed, Up 0, Down 0 Transit LSP: 2 sessions To From State Packets Bytes LSPname 172.16.1.1 172.16.2.1 Up 0 0 To-Site-A 172.16.2.1 172.16.1.1 Up 0 0 To-Site-B Total 2 displayed, Up 2, Down 0
Initiate traffic between LAN-A and LAN-B and check the LSP statistics on P_router to confirm that LSPs are being used.
Check the LSP statistics on P_router. The below output shows 0 packets through the LSP.
Initiate an ICMP ping from LAN-A device to LAN-B device.
root@LAN-A> ping 10.10.200.2 rapid count 100 PING 10.10.200.2 (10.10.200.2): 56 data bytes !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! --- 10.10.200.2 ping statistics --- 100 packets transmitted, 100 packets received, 0% packet loss round-trip min/avg/max/stddev = 2.182/2.683/9.330/0.737 ms
Check the LSP statistics on P_router again. The below output shows 100 packets through the LSP, which matches with the ICMP count.
root@P_router> show mpls lsp statistics Ingress LSP: 0 sessions Total 0 displayed, Up 0, Down 0 Egress LSP: 0 sessions Total 0 displayed, Up 0, Down 0 Transit LSP: 2 sessions To From State Packets Bytes LSPname 172.16.1.1 172.16.2.1 Up 100 9200 To-Site-A 172.16.2.1 172.16.1.1 Up 100 9200 To-Site-B Total 2 displayed, Up 2, Down 0