I85PREP
⌘ K
JNCIE-SP study materials
JNCIE-SP study resources

JNCIE-SP: Layer 3 VPNs

JNCIE-SP · Work through your exam, one topic at a time.

All guide sections

Layer 3 VPNs

What this domain tests

Layer 3 VPN questions test VRF construction, MP-BGP VPNv4 signaling, route-target import/export, PE-CE routing, and inter-AS designs. The key distinction is between the RD, which makes prefixes unique, and the RT, which controls distribution.

Core rules

  • A VRF is a routing instance with instance-type vrf, interfaces, a route distinguisher, and a route target: set routing-instances CUST instance-type vrf, route-distinguisher 65000:100, vrf-target target:65000:100.
  • vrf-target sets both import and export. Separate vrf-import and vrf-export policies are used for extranets and complex leaking.
  • MP-BGP carries VPNv4 NLRI with family inet-vpn unicast. The RD prepends uniqueness; the RT extended community is matched on import.
  • PE-CE routing can be static, OSPF, or BGP. OSPF in a VRF may need domain-id and domain-tag to prevent loops when routes return to the backbone.
  • Hub-and-spoke: the hub imports the spoke RT and exports a hub RT; spokes import only the hub RT, so spoke-to-spoke traffic must transit the hub.
  • Inter-AS Option A uses VRF-to-VRF on ASBRs; Option B uses MP-eBGP VPNv4 between ASBRs; Option C uses multihop MP-eBGP between PEs plus an inter-AS LSP, with ASBRs not holding VPN routes.
  • Carrier-of-carriers uses a VRF on the provider PE to carry the customer's own MPLS network.

Worked example

Hub-and-spoke with hub RT 65000:999 and spoke RT 65000:100:

Hub VRF:   vrf-target import target:65000:100
           vrf-target export target:65000:999
Spoke VRF: vrf-target import target:65000:999
           vrf-target export target:65000:100

Reasoning: the hub imports spoke routes and exports its aggregate or default to the hub RT; spokes import the hub RT only, so they never install each other's routes directly.

Traps

  • Setting vrf-target after separate import/export policies can overwrite them.
  • An RD mismatch does not prevent connectivity if RTs match; an RT mismatch always does.
  • P routers do not need VPN routes, only transport labels.
  • Option C requires an end-to-end LSP and multihop MP-eBGP; ASBRs only forward labeled traffic.