Hi there!
If Im understanding what you are trying to do..The short answer is 'yes, you can.'
I have two Nexus 9000s connected via Eth1/1 peered over iBGP (RRs). Their sample configurations below:
Nexus-1# show run bgp
!Command: show running-config bgp
!Running configuration last done at: Mon Sep 19 21:20:42 2022
!Time: Mon Sep 19 21:27:39 2022
version 9.3(3) Bios:version 05.45
feature bgp
router bgp 65111
router-id 1.1.1.1
log-neighbor-changes
address-family ipv4 unicast
network 1.1.1.1/32
address-family vpnv4 unicast
neighbor 2.2.2.2
remote-as 65111
update-source loopback0
address-family vpnv4 unicast
send-community
send-community extended
route-reflector-client
vrf BLUE
address-family ipv4 unicast
vrf RED
address-family ipv4 unicast
Nexus-1# show run int loo0
!Command: show running-config interface loopback0
!Running configuration last done at: Mon Sep 19 21:20:42 2022
!Time: Mon Sep 19 21:30:47 2022
version 9.3(3) Bios:version 05.45
interface loopback0
description BGP Router-ID
ip address 1.1.1.1/32
ip router ospf Support-Forum area 0.0.0.0
Nexus-1# show run int e1/1
!Command: show running-config interface Ethernet1/1
!Running configuration last done at: Mon Sep 19 21:20:42 2022
!Time: Mon Sep 19 21:30:49 2022
version 9.3(3) Bios:version 05.45
interface Ethernet1/1
description To Nexus-2 iBGP
mtu 9216
no ip redirects
ip address 172.18.1.1/30
no ipv6 redirects
ip router ospf Support-Forum area 0.0.0.0
no shutdown
Nexus-2, who has a mock prefix in VRF RED and VRF BLUE respectively:
Nexus-2# show run bgp
!Command: show running-config bgp
!Running configuration last done at: Mon Sep 19 21:24:19 2022
!Time: Mon Sep 19 21:29:21 2022
version 9.3(3) Bios:version 05.45
feature bgp
router bgp 65111
router-id 2.2.2.2
log-neighbor-changes
address-family ipv4 unicast
network 2.2.2.2/32
address-family vpnv4 unicast
neighbor 1.1.1.1
remote-as 65111
update-source loopback0
address-family vpnv4 unicast
send-community
send-community extended
route-reflector-client
vrf BLUE
log-neighbor-changes
address-family ipv4 unicast
network 65.33.33.33/32
vrf RED
address-family ipv4 unicast
network 65.22.22.22/32
Nexus-2# show run int loo0-2
!Command: show running-config interface loopback0-2
!Running configuration last done at: Mon Sep 19 21:24:19 2022
!Time: Mon Sep 19 21:29:55 2022
version 9.3(3) Bios:version 05.45
interface loopback0
description BGP Router-Id Loo
ip address 2.2.2.2/32
ip router ospf Support-Forum area 0.0.0.0
interface loopback1
description VRF RED
vrf member RED
ip address 65.22.22.22/32
interface loopback2
description VRF BLUE
vrf member BLUE
ip address 65.33.33.33/32
Nexus-2# show run int e1/1
!Command: show running-config interface Ethernet1/1
!Running configuration last done at: Mon Sep 19 21:24:19 2022
!Time: Mon Sep 19 21:30:16 2022
version 9.3(3) Bios:version 05.45
interface Ethernet1/1
description To Nexus-1 iBGP
mtu 9216
no ip redirects
ip address 172.18.1.2/30
no ipv6 redirects
ip router ospf Support-Forum area 0.0.0.0
no shutdown
You can see that although only peered once, they are exchanging routes from VRF BLUE and RED, without an additional peering over those VRFs as well.
Nexus-1# show bgp vpnv4 unicast summary
BGP summary information for VRF default, address family VPNv4 Unicast
BGP router identifier 1.1.1.1, local AS number 65111
BGP table version is 12, VPNv4 Unicast config peers 1, capable peers 1
4 network entries and 4 paths using 720 bytes of memory
BGP attribute entries [2/336], BGP AS path entries [0/0]
BGP community entries [0/0], BGP clusterlist entries [0/0]
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
2.2.2.2 4 65111 62 48 12 0 0 00:30:35 2
Nexus-1# show bgp vpnv4 unicast
BGP routing table information for VRF default, address family VPNv4 Unicast
BGP table version is 12, Local Router ID is 1.1.1.1
Status: s-suppressed, x-deleted, S-stale, d-dampened, h-history, *-valid, >-best
Path type: i-internal, e-external, c-confed, l-local, a-aggregate, r-redist, I-injected
Origin codes: i - IGP, e - EGP, ? - incomplete, | - multipath, & - backup, 2 - best2
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 65222:65222 (VRF RED)
*>i65.22.22.22/32 2.2.2.2 100 0 i
*>i65.33.33.33/32 2.2.2.2 100 0 i
Route Distinguisher: 65333:65333 (VRF BLUE)
*>i65.22.22.22/32 2.2.2.2 100 0 i
*>i65.33.33.33/32 2.2.2.2 100 0 i
P.S: Im guessing the MPLS features are not enabled in the Nexus switch you are trying to do this in yet and that is likely why you cannot see the vpnv4 AF anywhere yet.
Example -- Quick neighbor config and vpnv4 AF missing:
Nexus-2(config-router-af)# router bgp 65111
Nexus-2(config-router)# router-id 2.2.2.2
Nexus-2(config-router)# log-neighbor-changes
Nexus-2(config-router)# address-family ipv4 unicast
Nexus-2(config-router-af)# neighbor 1.1.1.1
Nexus-2(config-router-neighbor)# address-family ?
ipv4 Configure IPv4 address-family
ipv6 Configure IPv6 address-family
l2vpn Configure L2VPN address-family
link-state Configure link-state address-family
But if I enable the feature set for MPLS, then vpnv4 AF becomes available:
Nexus-2(config)# install feature-set mpls
Nexus-2(config)# feature-set mpls
Nexus-2(config)# feature mpls l3vpn
Now going back to the BGP configuration, you can see vpnv4 is now an option:
Nexus-2(config-router-neighbor)# address-family ?
ipv4 Configure IPv4 address-family
ipv6 Configure IPv6 address-family
l2vpn Configure L2VPN address-family
link-state Configure link-state address-family
vpnv4 Configure IPv4 VPN address-family
vpnv6 Configure IPv6 VPN address-family
Hope that helps get you started on this.
- Andrea, CCIE #56739 R&S
