Subject: Hub abd spoke and MPLS-BGP-VPN

From: somnath mani <[email-masked]>
Date: Tue, 6 Aug 2002 12:44:55 -0700

Hi,
In a hub abd spoke topology implemented using
BGP-MPLS-VPN, a hub PE is talking OSPF with a HUB CE
using OSPF. When the hub PE receives route updates
from spoke PEs ( via BGP), it generates summary/ASE
LSAs and sends them across to the CE which forwards
them to the hub PE back in to a different vrf, from
where on these routes are exported back to the spoke
PEs.

The draft says that when we genereate summary lsas we
set the DN bit ( if the pe-ce link is in area
0).similarly for ASEs we set the vpn route tag. this
is to prevent looping.

In the above scenario, when the CE forwards the lsas
back to PE in  a different vrf, we see that the DN bit
is set and we do not install the route. Am I missing
something in the draft ? how do we make the DN bit vrf
aware ?

Thanks
Somnath

__________________________________________________
Do You Yahoo!?
Yahoo! Health - Feel better, live better
http://health.yahoo.com

---

From: Peter Psenak <[email-masked]>
Date: Wed, 7 Aug 2002 13:53:44 +0200

Somnath,

> back to PE in  a different vrf, we see that the DN bit

why would a CE router forward LSAs from one vrf to another one?

> something in the draft ? how do we make the DN bit vrf

DN-bit is not VRF aware. DN-bit signals that prefix has been imported
from the VPN backbone.

thanks,
Peter

---

From: Anton Smirnov <[email-masked]>
Date: Wed, 7 Aug 2002 16:24:24 +0200

Hi,
   leaking from one VRF to another on one PE router is frequent design if
end-customer wants central processing for some services. Say, end-customer
has firewall on his central site and wants to ensure that all traffic
between all his sites and other VRFs/Internet/whatever-else goes thru the
central firewall (it's good from maintainability point of view and stateful
inspection).
   OK, in case of firewall it is unlikely to have 1 OSPF process on both
sides, but I'm sure other similar setups can (and will be) invented.
   DN bit does not support this type of 'automatic' discovery and
manipulation. I think implementation may provide means to manually configure
selective DN bit suppression, if deemed needed.

Anton