Subject: RE: Questions on multiprovider VPN operations in RFC2547bis

From: "Shekhar, Ravi" <[email-masked]>
Date: Tue, 2 Jan 2001 17:02:16 -0500

I am not sure why would you want RD to be changed, but my
guess is that you are wondering how routes will be imported
if the route-descriptors are different. 

From my limited understanding, it seems it is not necessary to 
change RD for this purpose. RDs help in distinguishing 
same route prefixes from different VPNs. 
Its the route-target which determines which routes should be 
imported and one can configure multiple (appropriate) route-targets 
to be imported on the router on each site of the VPN.

- Ravi Shekhar.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Tuesday, January 02, 2001 4:43 PM
> To: Yakov Rekhter
> Cc: [email-masked]
> Subject: Re: Questions on multiprovider VPN operations in RFC2547bis
> 
> 
> 
> 
> From:  James Huang@MITEL on 01/02/2001 01:43 PM PST
> Yakov,
>      Should P1 always convert the RD if the RD for the 
> customer in AS1 and AS3
> are different?  Or is it P3's responsibility to do the 
> conversion?  One of them
> should do it, right?
> 
> -- James Huang
> 
> 
> 
> 
> 
> Yakov Rekhter <[email-masked]> on 01/02/2001 12:33:39 PM
> 
> To:   James Huang/USA/Mitel@Mitel
> cc:   [email-masked]
> 
> Subject:  Re: Questions on multiprovider VPN operations in RFC2547bis
> 
> 
> 
> James,
> 
> >      RFC2547bis supports multiprovider VPNs in which a VPN 
> customer has two
> > sites each served by a distinct VPN service provider.  The 
> VPN service provid
> ers
> > serving the customer are themselves served by yet another 
> VPN service provide
> r.
> > Suppose we have the following VPN deployment,
> >
> >      CE1  ---  (PE11  --  P1  -- PE12)  ==  (PE21 --  P2  
> -- PE22)  ==  (PE31
> > --  P3  -- PE32)  --  CE2
> >
> > PE11, P1, and PE12 are in AS1, PE21, P2, and PE22 are in 
> AS2, and PE31, P3, a
> nd
> > PE32 are in AS3.
> > Assuming that  P1 and P3 are route reflectors and are 
> talking EBGP to each
> > other.  So when PE32 advertises a VPN-ipv4 route for CE2 to 
> P3, P3 will in tu
> rn
> > advertise the route to P1.  When P1 receives the 
> advertisement, it will then
> > send the advertisement to PE11 and PE12.
> >
> > Here are my questions:
> >      (1) A VPN service provider can assign route 
> distinguisher (RD) at its own
> > discretion.
> 
> Correct.
> 
> >             So the VPN customer's RD in AS1 will likely be 
> different from its
> > RD in AS3.
> 
> Correct too.
> 
> > When P1 receives the VPN-ipv4 route advertisement from P3, does the
> > RD in the advertisement need to be converted first before 
> being sent to PE11
> > and PE12?
> 
> No, it does not *need* to be converted. However, P1 *may* do the
> conversion.
> 
> >      (2) How about route target extended communities?  Do 
> they need to be
> > converted too?
> 
> The same applies to route targets. They need not be converted by P1.
> But P1 *may* do the conversion.
> 
> Yakov.
> 
> 
> 
>

---

From: Robert Raszuk <[email-masked]>
Date: Tue, 02 Jan 2001 16:19:21 -0800

> I am not sure why would you want RD to be changed, but my

I responded on this email in the NBVPN list but here let me just comment
on the above. 

The RD will need to be changed when there is any possibility that the
duplication of RD value is possible. This has nothing to do with
importing to vrfs or not but with maintaining the correct and not
confused data structures (for example vpnv4 route reflector tries) in
the provider's network.

To summarise if one uses part of his registered AS# in the RD string no
change of RD is needed in the incomming updates and this is the simples
way to avoid the confusion. The incomming RD check still would need to
be done of course to prevent attacks from not trusted peers :).

R.

> "Shekhar, Ravi" wrote: