Inter-AS L3VPN After Acquisition with Security Constraints
Provider A (AS 65100) with 100 PEs and 2,000 VRFs acquires Provider B (AS 65200) with 60 PEs and 500 VRFs. Both run MPLS L3VPN but use different route-target conventions and separate IGPs. The merged service must support 15,000 VPNv4 routes and 2,500 VRFs, with traffic between any A and B customer. B's security team refuses to expose its internal P and PE loopbacks to A's network, and A refuses to expose its core. The two ASBRs are in a neutral facility and can run eBGP. Option A would require 2,500 VRF sub-interfaces; Option B would put all VPN routes on the ASBRs; Option C is proposed with BGP-LU. The migration window is six months, and both networks must remain operational during the merge.
1. Recommend an inter-AS model and justify it against the 2,500-VRF and security constraints.
Read the worked answer
Recommend Option B, despite the initial preference for Option C. Option A is not viable because 2,500 VRF sub-interfaces on the ASBR pair would create an unmanageable per-VRF configuration and troubleshooting burden. Option C is operationally attractive because ASBRs carry only labeled IPv4 routes for PE loopbacks, but it requires B's PE loopbacks to be visible to A, which directly conflicts with B's security policy.
Option B keeps the ASBRs as the inter-AS boundary: they exchange MP-eBGP VPNv4 routes, rewrite the next-hop to themselves, and allocate new labels. B's internal P and PE loopbacks are not exposed to A; only the ASBR addresses are. The ASBRs do hold 15,000 VPNv4 routes, which is modest for modern hardware, and they do not need 2,500 VRF interfaces. Use route-target constraints and policy to limit which VPNs are exchanged. Confirm ASBR FIB and label scale, and run a pair for redundancy. Option B is the best fit for the stated security constraint and the route scale.
2. Describe the Option B control-plane and data-plane operation, including next-hop, label, and route-target handling.
Read the worked answer
In the control plane, each ASBR runs MP-eBGP VPNv4 with the other ASBR. When ASBR1 receives a VPNv4 route from its internal PEs, it selects the route, sets the next-hop to its own inter-AS interface address, and allocates a local label for the VPN route. It advertises the route to ASBR2 with the extended communities, including the route targets, unchanged. ASBR2 performs the same process toward AS 65200. Route-target constraints can be used so the ASBRs exchange only the VPNs that are actually needed.
In the data plane, the ingress PE pushes the VPN label and an IGP/LDP label toward ASBR1. ASBR1 removes the incoming transport label, maps the VPN label to the label it advertised to ASBR2, and forwards with a new transport label across the inter-AS link. ASBR2 performs the label swap again. The egress PE receives the VPN label and uses it to identify the VRF. The ASBRs do not need VRF interfaces, but they must maintain VPNv4 routes and label bindings. Test label accounting and TTL behavior across the ASBR pair.
3. If B later permits a controlled subset of PE loopbacks to be exposed, how would you migrate from Option B to Option C without a outage?
Read the worked answer
Treat it as a parallel-path migration, not a cutover. First enable BGP-LU on both ASBR pairs and advertise only the approved subset of B's PE loopbacks into A, with strict prefix filters and no P-router loopbacks. Verify that A's ASBRs have labeled reachability to those PE loopbacks. Then establish multihop MP-eBGP VPNv4 sessions directly between the route reflectors or PEs, while keeping the existing Option B ASBR VPNv4 sessions active.
Use route policy to prefer the new Option C paths for a small set of test VRFs, and verify label stacks, next-hop reachability, and return traffic. Migrate VRFs in batches by adjusting route-target import/export policy or local preference, monitoring traffic and failure behavior at each step. Keep Option B as a fallback until all VRFs are moved. Finally, remove VPNv4 from the ASBRs and retain BGP-LU only for the approved PE loopbacks. The security gain is that P routers remain hidden; the residual exposure is the documented PE loopback subset.