Vazamento de rotas entre VRFs com iBGP entre PE e CE

[leandro1977]

Na topologia abaixo os CEs não conseguem receber as rotas um do outro.

iGP está OK

LDP está OK

VPNV4 está OK

CA-CE1

interface Loopback0
ip address 201.10.1.1 255.255.255.255
!

interface Ethernet0/0
ip address 205.5.16.6 255.255.255.0
!
router bgp 100
bgp router-id 1.1.1.1
bgp log-neighbor-changes
neighbor 205.5.16.1 remote-as 100
!
address-family ipv4
network 201.10.1.1 mask 255.255.255.255
neighbor 205.5.16.1 activate
exit-address-family

PE1

vrf definition CLIENTE-A
rd 100:1
!
address-family ipv4
route-target export 100:1
route-target import 100:1
exit-address-family

interface Loopback0
ip address 200.10.1.1 255.255.255.255
ip ospf 100 area 0
!
interface Ethernet0/0
ip address 205.5.12.1 255.255.255.0
ip ospf 100 area 0
mpls ip
!
interface Ethernet0/2
vrf forwarding CLIENTE-A
ip address 205.5.16.1 255.255.255.0
!

router ospf 100
mpls ldp sync
mpls ldp autoconfig
router-id 10.10.10.10
!
router bgp 100
bgp router-id 10.10.10.10
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 200.10.4.4 remote-as 100
neighbor 200.10.4.4 update-source Loopback0
!
address-family ipv4
exit-address-family
!
address-family vpnv4
neighbor 200.10.4.4 activate
neighbor 200.10.4.4 send-community extended
exit-address-family
!
address-family ipv4 vrf CLIENTE-A
neighbor 205.5.16.6 remote-as 100
neighbor 205.5.16.6 activate
neighbor 205.5.16.6 internal-vpn-client
neighbor 205.5.16.6 route-reflector-client
neighbor 205.5.16.6 next-hop-self
exit-address-family

P

interface Loopback0
ip address 200.10.2.2 255.255.255.255
ip ospf 100 area 0
!
interface Ethernet0/0
ip address 205.5.12.2 255.255.255.0
ip ospf 100 area 0
mpls ip
!
interface Ethernet0/1
ip address 205.6.12.2 255.255.255.0
ip ospf 100 area 0
mpls ip
!

router ospf 100
mpls ldp sync
mpls ldp autoconfig
router-id 30.30.30.30
!

PE2
vrf definition CLIENTE-A
rd 100:1
!
address-family ipv4
route-target export 100:1
route-target import 100:1
exit-address-family

interface Loopback0
ip address 200.10.4.4 255.255.255.255
ip ospf 100 area 0
!
interface Ethernet0/1
ip address 205.6.12.1 255.255.255.0
ip ospf 100 area 0
mpls ip
!
interface Ethernet0/2
vrf forwarding CLIENTE-A
ip address 205.5.47.1 255.255.255.0
!
router ospf 100
mpls ldp sync
mpls ldp autoconfig
router-id 20.20.20.20
!
router bgp 100
bgp router-id 20.20.20.20
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 200.10.1.1 remote-as 100
neighbor 200.10.1.1 update-source Loopback0
!
address-family ipv4
exit-address-family
!
address-family vpnv4
neighbor 200.10.1.1 activate
neighbor 200.10.1.1 send-community extended
exit-address-family
!
address-family ipv4 vrf CLIENTE-A
neighbor 205.5.47.7 remote-as 100
neighbor 205.5.47.7 activate
neighbor 205.5.47.7 internal-vpn-client
neighbor 205.5.47.7 route-reflector-client
neighbor 205.5.47.7 next-hop-self
exit-address-family

CA-CE2

interface Loopback0
ip address 201.10.2.2 255.255.255.255
!
interface Ethernet0/0
ip address 205.5.47.7 255.255.255.0

!

router bgp 100
bgp router-id 2.2.2.2
bgp log-neighbor-changes
neighbor 205.5.47.1 remote-as 100
!
address-family ipv4
network 201.10.2.2 mask 255.255.255.255
neighbor 205.5.47.1 activate
exit-address-family

SAIDA DE COMANDOS

[M02@rt37]

Hello @leandro1977 

route reflector-client command should be only on your P router.

[SamuelGLN · Accepted solution]

Leandro, nesse cenário o ideal seria utilizar um ASN privado no lado do cliente para fechar as sessões entre PE-CE. Por exemplo, utilizar o ASN 100 no seu PE (da mesma forma que fez) e utilizar no ASN 65000 no lado dos CEs. Da forma que está configurado, por ter dois PEs distintos operando como RR, não terá o comportamento desejado na propagação das rotas aprendidas via iBGP.