I have had a few requests for this so I thought i'd put it on-list. Thanks, Aaron Daniels
> -----Original Message----- > From: [email protected] [mailto:cisco-nsp- > [email protected]] On Behalf Of Aaron Daniels - Lists > Sent: Thursday, 18 December 2008 6:13 PM > To: 'Tim Durack'; [email protected] > Subject: Re: [c-nsp] MPLS-VPN migration > > We just tackled this one in our organisation. > > 2 Gotchas. > > 1. Router-id must be different between peers, make sure your code > supports > vrf specific router-id. > 2. iBGP was very messy IMHO, so we went with eBGP using local-as to > have > each vrf appear to be a different 65xxx AS > > I can sent you my lab config's tomorrow. > > Thanks, > Aaron > > > -----Original Message----- > > From: [email protected] [mailto:cisco-nsp- > > [email protected]] On Behalf Of Tim Durack > > Sent: Thursday, 18 December 2008 1:54 AM > > To: [email protected] > > Subject: [c-nsp] MPLS-VPN migration > > > > Looking for some "creative" ideas on how best to accomplish this: > > > > We are migrating a traditional enterprise-style IP network to an > > MPLS-VPN network. All the infrastructure MPLS/IGP/MP-BGP work is > > essentially done (it's a purely PE-PE network, no P routers > anywhere.) > > > > All "customer" networks are still in the global table. I need to > > migrate them into VPN groups, but maintain full reachability between > > global and VRFs during the migration. Route-leaking will be > configured > > between VRFs, and at a later stage some kind of firewall will be > > employed between VPNs. The hard part is getting everything into the > > VPNs first (without anyone noticing too much :-) > > > > Ideally I'd like to bring up BGP sessions between the global table > and > > VRFs on each PE. I notice I can do BGP sessions between VRFs, but > > can't quite wrap my head around global->VRF BGP. Is this even > > possible? > > > > Thanks for thinking about it. > > > > Tim:> > > _______________________________________________ > > cisco-nsp mailing list [email protected] > > https://puck.nether.net/mailman/listinfo/cisco-nsp > > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/
router bgp 1 neighbor FIREWALL peer-group neighbor FIREWALL local-as 65255 no-prepend replace-as neighbor FIREWALL ebgp-multihop 255 neighbor 192.168.96.12 remote-as 65001 neighbor 192.168.96.12 peer-group FIREWALL neighbor 192.168.96.20 remote-as 65002 neighbor 192.168.96.20 peer-group FIREWALL ! address-family ipv4 neighbor FIREWALL route-map VRF-POLICY-IN in neighbor FIREWALL route-map VRF-POLICY-OUT out neighbor 192.168.96.12 activate neighbor 192.168.96.20 activate aggregate-address 10.255.0.0 255.255.0.0 summary-only exit-address-family ! address-family ipv4 vrf ONE neighbor 192.168.96.4 remote-as 65255 neighbor 192.168.96.4 local-as 65001 no-prepend replace-as neighbor 192.168.96.4 ebgp-multihop 255 neighbor 192.168.96.4 activate neighbor 192.168.96.4 default-originate neighbor 192.168.96.4 route-map VRF-POLICY-IN in neighbor 192.168.96.4 route-map VRF-POLICY-OUT out bgp router-id 192.168.96.12 aggregate-address 10.1.0.0 255.255.0.0 summary-only exit-address-family ! address-family ipv4 vrf TWO neighbor 192.168.96.4 remote-as 65255 neighbor 192.168.96.4 local-as 65002 no-prepend replace-as neighbor 192.168.96.4 ebgp-multihop 255 neighbor 192.168.96.4 activate neighbor 192.168.96.4 route-map VRF-POLICY-IN in neighbor 192.168.96.4 route-map VRF-POLICY-OUT out bgp router-id 192.168.96.20 aggregate-address 10.2.0.0 255.255.0.0 summary-only exit-address-family ! ip route 192.168.96.0 255.255.252.0 192.168.96.1 ip route vrf ONE 192.168.96.0 255.255.252.0 192.168.96.9 ip route vrf TWO 192.168.96.0 255.255.252.0 192.168.96.17 ! ip prefix-list NOADVERTISE-OUT seq 5 permit 192.168.96.0/22 ge 22 ! route-map VRF-POLICY-OUT deny 10 match ip address prefix-list NOADVERTISE-OUT ! route-map VRF-POLICY-OUT permit 20 ! route-map VRF-POLICY-IN permit 10 set local-preference 200
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
