So, in an effort build a sham link lab setup I have the following setup:   PE1 ----- CE1 running OSPF in VRF VPN_A PE2 ----- CE2 running OSPF in VRF VPN_A PE1 is IOS PE2 is XR   There is a backdoor link from CE1 to CE2. PE1 and PE2 have a BPG vpnv4 connection to each other. MPLS and LDP running across core. OSPF is redistributing into BPG and vice versa on both PE1 and PE2.   Classic sham link lab.   Before I create the same link, I create loopback 1 (10.2.2.2/32) on PE1 and then use the network command under BGP to get it into the BGP.   I do NOT enable OSPF on the loopback. I need PE2 to see the best path to loopback1 over the MPLS superbackbone NOT over the OSPF connection to CE2.   Now that I think SHOULD happen once I enter the network command is as follows:   OSPF sees 10.2.2.2/32 in BGP and redistributes it as a type 5 AND SETS THE DOWN BIT. The LSA is flooded throughout the OSPF domain and PE2 gets it. It does not redistribute back into BGP because the down bit it set. But if I look on PE1 I can see the down bit is not being set...   CONFIG: PE1#sh run | sec router bgp router bgp 100 bgp router-id 2.2.2.2 bgp log-neighbor-changes no bgp default ipv4-unicast neighbor 19.19.19.19 remote-as 100 neighbor 19.19.19.19 update-source Loopback0 ! address-family ipv4 exit-address-family ! address-family vpnv4 neighbor 19.19.19.19 activate neighbor 19.19.19.19 send-community extended exit-address-family ! address-family ipv4 vrf VPN_A network 10.2.2.2 mask 255.255.255.255 redistribute ospf 100 exit-address-family PE1#sh run int lo1 Building configuration... Current configuration : 118 bytes ! interface Loopback1 description sham-link loopback vrf forwarding VPN_A ip address 10.2.2.2 255.255.255.255 end PE1#sh run | sec router ospf 100 router ospf 100 vrf VPN_A router-id 22.22.22.22 area 0 authentication message-digest redistribute bgp 100 subnets PE1# OUTPUT: PE1#sh ip ospf 100 database external 10.2.2.2 OSPF Router with ID (22.22.22.22) (Process ID 100) Type-5 AS External Link States LS age: 861 Options: (No TOS-capability, DC, Upward) LS Type: AS External Link Link State ID: 10.2.2.2 (External Network Number ) <<<<<<<<<<<< locally redistributed, ready to be sent to PE1, but down bit is not set Advertising Router: 22.22.22.22 LS Seq Number: 80000002 Checksum: 0x17FD Length: 36 Network Mask: /32 Metric Type: 2 (Larger than any link state path) MTID: 0 Metric: 1 Forward Address: 0.0.0.0 External Route Tag: 3489661028 LS age: 2701 Options: (No TOS-capability, DC, Downward) <<<<<<<< THIS IS PE2 (19.19.19.19) redistributing its VPNv4 BGP route back into OSPF and correctly setting down bit. LS Type: AS External Link Link State ID: 10.2.2.2 (External Network Number ) Advertising Router: 119.119.119.119 LS Seq Number: 80000001 Checksum: 0x28E7 Length: 36 Network Mask: /32 Metric Type: 2 (Larger than any link state path) MTID: 0 Metric: 1 Forward Address: 0.0.0.0 External Route Tag: 3489661028 PE1# According to https://tools.ietf.org/html/rfc4576 section 4 "When a type 3, 5, or 7 LSA is sent from a PE to a CE, the DN bit MUST be set.".     Can anyone advise why this isn't happening? ... View more

I'm reading through my notes to prepare of my next exam, and I'm having trouble understanding the rules of CB Policing as they are layed out in the book -specifically when it comes to the question of what tokens are removed if the Exceed action is to be perform for a Single-Rate Three-Color (Dual buckets) scenario.    I understand the rules to be as follows:   A packet with x bytes in it arrives.    If x <= The number of tokens in the Bc bucket - then x bytes are removed and the conform action is performed. The number of tokens in the Bc bucket  < x  <=The number of tokens in the Be bucket  - then x bytes are removed from the Be bucket and the exceed action is performed.  If x > The number of tokens in the Be bucket - then no tokens are removed and the violate action is performed.   Now that seems pretty simple at first glance, but what happens if a 51 byte packet arrives and the size of the Bc bucket is 50, and it is full, and the size of the Be bucket is 100 and it is a quarter full (25 tokens).   It doesn't conform. 51> 50. But it doesn't exceed either. Since 51>25. It looks like this would violate.    But there are 75 tokens available to be used... So the policer can send up to 75 bytes.... right?   Should the exceed rule not then be the following:    The number of tokens in the Bc bucket  < x <= (The number of tokens in the Bc bucket + The number of tokens in the Be bucket)  - then x bytes are removed from the Be and Bc buckets (emptying the Bc bucket first) and the exceed action is performed.   Is that right or have I misunderstood?   I seems to me that if the rules as I initially stated them are true, the the Be bucket would have to be larger that the Bc bucket otherwise it would always fail its check if the Bc bucket did. I suppose what I am asking, is whether or not the Be bucket tokens are considered together, with the Bc bucket tokens, or independently.    I hope that makes sense. Thanks in advance for any help :)     ... View more