BGP RT filter¶
Overview¶
BGP RT filter (also known as constrained route distribution for BGP) is a BGP extension that allows routers to receive only the prefixes associated with the RT values they are interested in.
By default, BGP routers receive the full L3VPN table from their peers but may not use all the received prefixes. PE routers selectively install in RIB only the prefixes that match their configured route-target imports. While they can discard unwanted prefixes using the BGP no-retain feature, a more efficient approach consists in preventing their advertising in the first place.
RFC 4684 standard introduces a RT subscription mechanism, allowing routers to advertise their interest in specific RTs. This enables peers to announce only the relevant L3VPN prefixes, reducing unnecessary prefix propagation. The subscription process is implemented using RT membership new type of BGP prefix (AFI: 1 (IPv4) and SAFI: 132).
Configuration¶
This section demonstrates how to configure BGP RT filter to optimize prefix distribution in a standard BGP L3VPN setup. The underlay network uses IS-IS as the IGP and LDP for MPLS label distribution.
ce1 and ce3 belong to the same routing domain, represented as L3VRF RED on pe1 and pe3. Similarly, ce2 and ce4 belong to a separate routing domain, represented as L3VRF BLUE on pe2 and pe3.
rr1 and rr2 serve as route reflectors for AS 65000.
IS-IS, LDP and BGP L3VPN configuration¶
This step outlines the configuration of the L3VPN setup without the RT filter, which will be introduced in the next step.
Underlay interface configuration¶
The underlay network uses subnets from 10.0.0.0/8 for inter-device
interconnections and 192.168.0.0/16 for loopback addresses.
rr1 running config# / vrf main interface physical eth-rr2 ipv4 address 10.0.100.101/24
rr1 running config#! / vrf main interface physical eth-rr2 port pci-b0s4
rr1 running config# / vrf main interface physical eth-pe1 ipv4 address 10.0.1.101/24
rr1 running config#! / vrf main interface physical eth-pe1 port pci-b0s5
rr1 running config# / vrf main interface physical eth-pe2 ipv4 address 10.0.2.101/24
rr1 running config#! / vrf main interface physical eth-pe2 port pci-b0s6
rr1 running config# / vrf main interface loopback lo1 ipv4 address 192.168.0.101/32
rr2 running config# / vrf main interface physical eth-rr1 ipv4 address 10.0.100.102/24
rr2 running config#! / vrf main interface physical eth-rr1 port pci-b0s4
rr2 running config# / vrf main interface physical eth-pe3 ipv4 address 10.0.3.102/24
rr2 running config#! / vrf main interface physical eth-pe3 port pci-b0s5
rr2 running config# / vrf main interface loopback lo1 ipv4 address 192.168.0.102/32
pe1 running config# / vrf main interface physical eth-rr1 ipv4 address 10.0.1.1/24
pe1 running config#! / vrf main interface physical eth-rr1 port pci-b0s4
pe1 running config# / vrf main interface loopback lo1 ipv4 address 192.168.0.1/32
pe2 running config# / vrf main interface physical eth-rr1 ipv4 address 10.0.2.2/24
pe2 running config#! / vrf main interface physical eth-rr1 port pci-b0s4
pe2 running config# / vrf main interface loopback lo1 ipv4 address 192.168.0.2/32
pe3 running config# / vrf main interface physical eth-rr2 ipv4 address 10.0.3.3/24
pe3 running config#! / vrf main interface physical eth-rr2 port pci-b0s4
pe3 running config# / vrf main interface loopback lo1 ipv4 address 192.168.0.3/32
IGP configuration with IS-IS¶
IS-IS is configured as the IGP on the PE routers and route reflectors to distribute the loopback addresses, which will serve as the BGP peer endpoints within the underlay AS.
rr1 running config# / vrf main routing isis instance 1
rr1 running instance 1# area-address 49.0000.0000.0101.00
rr1 running instance 1# is-type level-1
rr1 running instance 1# / vrf main routing
rr1 running routing# interface lo1
rr1 running interface lo1# isis area-tag 1
rr1 running interface lo1#! isis ipv4-routing true
rr1 running interface lo1# isis passive true
rr1 running interface lo1# ..
rr1 running routing# interface eth-rr2
rr1 running interface eth-rr2# isis area-tag 1
rr1 running interface eth-rr2#! isis ipv4-routing true
rr1 running interface eth-rr2# isis network-point-to-point true
rr1 running interface eth-rr2# ..
rr1 running routing# interface eth-pe1
rr1 running interface eth-pe1# isis area-tag 1
rr1 running interface eth-pe1#! isis ipv4-routing true
rr1 running interface eth-pe1# isis network-point-to-point true
rr1 running interface eth-pe1# ..
rr1 running routing# interface eth-pe2
rr1 running interface eth-pe2# isis area-tag 1
rr1 running interface eth-pe2#! isis ipv4-routing true
rr1 running interface eth-pe2# isis network-point-to-point true
rr1 running interface eth-pe2# ..
rr2 running config# / vrf main routing isis instance 1
rr2 running instance 1# area-address 49.0000.0000.0102.00
rr2 running instance 1# is-type level-1
rr2 running instance 1# / vrf main routing
rr2 running routing# interface lo1
rr2 running interface lo1# isis area-tag 1
rr2 running interface lo1#! isis ipv4-routing true
rr2 running interface lo1# isis passive true
rr2 running interface lo1# ..
rr2 running routing# interface eth-rr1
rr2 running interface eth-rr1# isis area-tag 1
rr2 running interface eth-rr1#! isis ipv4-routing true
rr2 running interface eth-rr1# isis network-point-to-point true
rr2 running interface eth-rr1# ..
rr2 running routing# interface eth-pe3
rr2 running interface eth-pe3# isis area-tag 1
rr2 running interface eth-pe3#! isis ipv4-routing true
rr2 running interface eth-pe3# isis network-point-to-point true
rr2 running interface eth-pe3# ..
pe1 running config# / vrf main routing isis instance 1
pe1 running instance 1# area-address 49.0000.0000.0001.00
pe1 running instance 1# is-type level-1
pe1 running instance 1# / vrf main routing
pe1 running routing# interface lo1
pe1 running interface lo1# isis area-tag 1
pe1 running interface lo1#! isis ipv4-routing true
pe1 running interface lo1# isis passive true
pe1 running interface lo1# ..
pe1 running routing# interface eth-rr1
pe1 running interface eth-rr1# isis area-tag 1
pe1 running interface eth-rr1#! isis ipv4-routing true
pe1 running interface eth-rr1# isis network-point-to-point true
pe1 running interface eth-rr1# ..
pe2 running config# / vrf main routing isis instance 1
pe2 running instance 1# area-address 49.0000.0000.0002.00
pe2 running instance 1# is-type level-1
pe2 running instance 1# / vrf main routing
pe2 running routing# interface lo1
pe2 running interface lo1# isis area-tag 1
pe2 running interface lo1#! isis ipv4-routing true
pe2 running interface lo1# isis passive true
pe2 running interface lo1# ..
pe2 running routing# interface eth-rr1
pe2 running interface eth-rr1# isis area-tag 1
pe2 running interface eth-rr1#! isis ipv4-routing true
pe2 running interface eth-rr1# isis network-point-to-point true
pe2 running interface eth-rr1# ..
pe3 running config# / vrf main routing isis instance 1
pe3 running instance 1# area-address 49.0000.0000.0003.00
pe3 running instance 1# is-type level-1
pe3 running instance 1# / vrf main routing
pe3 running routing# interface lo1
pe3 running interface lo1# isis area-tag 1
pe3 running interface lo1#! isis ipv4-routing true
pe3 running interface lo1# isis passive true
pe3 running interface lo1# ..
pe3 running routing# interface eth-rr2
pe3 running interface eth-rr2# isis area-tag 1
pe3 running interface eth-rr2#! isis ipv4-routing true
pe3 running interface eth-rr2# isis network-point-to-point true
The IGP is considered converged when the IS-IS database lists all routers and the IPv4 routing table contains all interconnection subnets and loopback addresses.
pe1> show isis database
Area 1:
IS-IS Level-1 link-state database:
LSP ID PduLen SeqNumber Chksum Holdtime ATT/P/OL
pe1.00-00 * 55 0x00000001 0x8849 1163 0/0/0
pe2.00-00 55 0x00000001 0xcefd 1178 0/0/0
pe3.00-00 55 0x00000001 0x15b2 1149 0/0/0
rr1.00-00 93 0x00000001 0x8235 1164 0/0/0
rr2.00-00 85 0x00000002 0x8460 1161 0/0/0
5 LSPs
pe1> show ipv4-routes
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, N - NHRP, T - Table
> - selected route, * - FIB route, r - rejected, b - backup
L3VRF default:
I 10.0.1.0/24 [115/20] via 10.0.1.101, eth-rr1 inactive, weight 1, 00:00:05
C>* 10.0.1.0/24 is directly connected, eth-rr1, 00:00:44
I>* 10.0.2.0/24 [115/20] via 10.0.1.101, eth-rr1, weight 1, 00:00:05
I>* 10.0.3.0/24 [115/30] via 10.0.1.101, eth-rr1, weight 1, 00:00:05
I>* 10.0.100.0/24 [115/20] via 10.0.1.101, eth-rr1, weight 1, 00:00:05
C>* 192.168.0.1/32 is directly connected, lo1, 00:00:44
I>* 192.168.0.2/32 [115/30] via 10.0.1.101, eth-rr1, weight 1, 00:00:03
I>* 192.168.0.3/32 [115/40] via 10.0.1.101, eth-rr1, weight 1, 00:00:01
I>* 192.168.0.101/32 [115/20] via 10.0.1.101, eth-rr1, weight 1, 00:00:05
I>* 192.168.0.102/32 [115/30] via 10.0.1.101, eth-rr1, weight 1, 00:00:05
10 routes displayed.
LDP configuration¶
LDP is used to distribute MPLS labels for underlay routing.
pe1 running config# / vrf main routing mpls ldp
pe1 running ldp# router-id 192.168.0.1
pe1 running ldp# address-family ipv4
pe1 running ipv4#! discovery transport-address 192.168.0.1
pe1 running ipv4# interface eth-rr1
pe2 running config# / vrf main routing mpls ldp
pe2 running ldp# router-id 192.168.0.2
pe2 running ldp# address-family ipv4
pe2 running ipv4#! discovery transport-address 192.168.0.2
pe2 running ipv4# interface eth-rr1
pe3 running config# / vrf main routing mpls ldp
pe3 running ldp# router-id 192.168.0.3
pe3 running ldp# address-family ipv4
pe3 running ipv4#! discovery transport-address 192.168.0.3
pe3 running ipv4# interface eth-rr2
rr1 running config# / vrf main routing mpls ldp
rr1 running ldp# router-id 192.168.0.101
rr1 running ldp# address-family ipv4
rr1 running ipv4#! discovery transport-address 192.168.0.101
rr1 running ipv4# interface eth-rr2
rr1 running interface eth-rr2# ..
rr1 running ipv4# interface eth-pe1
rr1 running interface eth-pe1# ..
rr1 running ipv4# interface eth-pe2
rr2 running config# / vrf main routing mpls ldp
rr2 running ldp# router-id 192.168.0.102
rr2 running ldp# address-family ipv4
rr2 running ipv4#! discovery transport-address 192.168.0.102
rr2 running ipv4# interface eth-rr1
rr2 running interface eth-rr1# ..
rr2 running ipv4# interface eth-pe3
LDP is considered converged when the PE peerings are visible from the route reflectors, the route reflectors have discovered each other, and the routing tables show MPLS labels for all active IS-IS route entries.
rr1> show mpls ldp neighbor
AF ID State Remote Address Uptime
ipv4 192.168.0.1 OPERATIONAL 192.168.0.1 00:00:06
ipv4 192.168.0.2 OPERATIONAL 192.168.0.2 00:00:04
ipv4 192.168.0.102 OPERATIONAL 192.168.0.102 00:00:02
rr2> show mpls ldp neighbor
AF ID State Remote Address Uptime
ipv4 192.168.0.3 OPERATIONAL 192.168.0.3 00:00:03
ipv4 192.168.0.101 OPERATIONAL 192.168.0.101 00:00:02
pe1> show ipv4-routes
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, N - NHRP, T - Table
> - selected route, * - FIB route, r - rejected, b - backup
L3VRF default:
I 10.0.1.0/24 [115/20] via 10.0.1.101, eth-rr1 inactive, weight 1, 00:00:19
C>* 10.0.1.0/24 is directly connected, eth-rr1, 00:00:58
I>* 10.0.2.0/24 [115/20] via 10.0.1.101, eth-rr1, label implicit-null, weight 1, 00:00:19
I>* 10.0.3.0/24 [115/30] via 10.0.1.101, eth-rr1, label 18, weight 1, 00:00:19
I>* 10.0.100.0/24 [115/20] via 10.0.1.101, eth-rr1, label implicit-null, weight 1, 00:00:19
C>* 192.168.0.1/32 is directly connected, lo1, 00:00:58
I>* 192.168.0.2/32 [115/30] via 10.0.1.101, eth-rr1, label 17, weight 1, 00:00:17
I>* 192.168.0.3/32 [115/40] via 10.0.1.101, eth-rr1, label 19, weight 1, 00:00:15
I>* 192.168.0.101/32 [115/20] via 10.0.1.101, eth-rr1, label implicit-null, weight 1, 00:00:19
I>* 192.168.0.102/32 [115/30] via 10.0.1.101, eth-rr1, label 20, weight 1, 00:00:19
10 routes displayed.
Overlay interface configuration¶
The overlay addressing uses subnets from 172.16.0.0/16 for PE-to-CE interconnections and 172.20.0.0/16 for LAN addressing on the CE devices.
pe1 running config# / vrf main l3vrf RED
pe1 running l3vrf RED#! table-id 1001
pe1 running l3vrf RED# interface physical eth-ce1 ipv4 address 172.16.1.1/24
pe1 running l3vrf RED#! interface physical eth-ce1 port pci-b0s5
pe2 running config# / vrf main l3vrf BLUE
pe2 running l3vrf BLUE#! table-id 1002
pe2 running l3vrf BLUE# interface physical eth-ce2 ipv4 address 172.16.2.1/24
pe2 running l3vrf BLUE#! interface physical eth-ce2 port pci-b0s5
pe3 running config# / vrf main l3vrf RED
pe3 running l3vrf RED#! table-id 1001
pe3 running l3vrf RED# interface physical eth-ce3 ipv4 address 172.16.3.1/24
pe3 running l3vrf RED#! interface physical eth-ce3 port pci-b0s5
pe3 running l3vrf RED# / vrf main l3vrf BLUE
pe3 running l3vrf BLUE#! table-id 1002
pe3 running l3vrf BLUE# interface physical eth-ce4 ipv4 address 172.16.4.1/24
pe3 running l3vrf BLUE#! interface physical eth-ce4 port pci-b0s6
ce1 running config# / vrf main interface physical eth-pe1 ipv4 address 172.16.1.254/24
ce1 running config#! / vrf main interface physical eth-pe1 port pci-b0s4
ce1 running config# / vrf main interface physical eth-lan ipv4 address 172.20.1.1/24
ce1 running config#! / vrf main interface physical eth-lan port pci-b0s5
ce2 running config# / vrf main interface physical eth-pe2 ipv4 address 172.16.2.254/24
ce2 running config#! / vrf main interface physical eth-pe2 port pci-b0s4
ce2 running config# / vrf main interface physical eth-lan ipv4 address 172.20.2.1/24
ce2 running config#! / vrf main interface physical eth-lan port pci-b0s5
ce3 running config# / vrf main interface physical eth-pe3 ipv4 address 172.16.3.254/24
ce3 running config#! / vrf main interface physical eth-pe3 port pci-b0s4
ce3 running config# / vrf main interface physical eth-lan ipv4 address 172.20.3.1/24
ce3 running config#! / vrf main interface physical eth-lan port pci-b0s5
ce4 running config# / vrf main interface physical eth-pe3 ipv4 address 172.16.4.254/24
ce4 running config#! / vrf main interface physical eth-pe3 port pci-b0s4
ce4 running config# / vrf main interface physical eth-lan ipv4 address 172.20.4.1/24
ce4 running config#! / vrf main interface physical eth-lan port pci-b0s5
BGP configuration¶
BGP is configured on all routers. The CE-to-PE sessions carry
ipv4-unicast prefixes, which are redistributed into ipv4-vpn on the core
BGP sessions.
L3VRF RED uses 65000:100 as its route-target and 65000:1 as its
route-distinguisher, while L3VRF BLUE uses 65000:101 and 65000:2,
respectively.
The soft-reconfiguration-inbound and ebgp-requires-policy options are
configured specifically for the purpose of this setup.
The soft-reconfiguration-inbound option is optional but useful for inspecting
which router is advertising which ipv4-vpn prefixes. However, it requires the
router to maintain an additional inbound BGP table, which increases memory
usage.
The ebgp-requires-policy option is disabled for CE-to-PE peerings in this
setup to simplify configuration. In production environments, it is recommended
to enable this setting and apply appropriate route-maps to control inbound
prefixes learned from external peers.
pe1 running config# / vrf main routing bgp
pe1 running bgp#! as 65000
pe1 running bgp# router-id 192.168.0.1
pe1 running bgp# neighbor 192.168.0.101
pe1 running neighbor 192.168.0.101#! remote-as internal
pe1 running neighbor 192.168.0.101# update-source 192.168.0.1
pe1 running neighbor 192.168.0.101# address-family ipv4-unicast enabled false
pe1 running neighbor 192.168.0.101# address-family ipv4-vpn
pe1 running ipv4-vpn# enabled true
pe1 running ipv4-vpn# soft-reconfiguration-inbound true
pe1 running ipv4-vpn# / vrf main l3vrf RED routing bgp
pe1 running bgp# ebgp-requires-policy false
pe1 running bgp# address-family ipv4-unicast
pe1 running ipv4-unicast# l3vpn export label auto
pe1 running ipv4-unicast# l3vpn export route-distinguisher 65000:1
pe1 running ipv4-unicast# l3vpn export route-target 65000:100
pe1 running ipv4-unicast# l3vpn export vpn true
pe1 running ipv4-unicast# l3vpn import route-target 65000:100
pe1 running ipv4-unicast# l3vpn import vpn true
pe1 running ipv4-unicast# .. ..
pe1 running bgp# neighbor 172.16.1.254
pe1 running neighbor 172.16.1.254#! remote-as external
pe1 running neighbor 172.16.1.254# address-family ipv4-unicast nexthop-self
pe2 running config# / vrf main routing bgp
pe2 running bgp#! as 65000
pe2 running bgp# router-id 192.168.0.2
pe2 running bgp# neighbor 192.168.0.101
pe2 running neighbor 192.168.0.101#! remote-as internal
pe2 running neighbor 192.168.0.101# update-source 192.168.0.2
pe2 running neighbor 192.168.0.101# address-family ipv4-unicast enabled false
pe2 running neighbor 192.168.0.101# address-family ipv4-vpn
pe2 running ipv4-vpn# enabled true
pe2 running ipv4-vpn# soft-reconfiguration-inbound true
pe2 running ipv4-vpn# / vrf main l3vrf BLUE routing bgp
pe2 running bgp# ebgp-requires-policy false
pe2 running bgp# address-family ipv4-unicast
pe2 running ipv4-unicast# l3vpn export label auto
pe2 running ipv4-unicast# l3vpn export route-distinguisher 65000:2
pe2 running ipv4-unicast# l3vpn export route-target 65000:101
pe2 running ipv4-unicast# l3vpn export vpn true
pe2 running ipv4-unicast# l3vpn import route-target 65000:101
pe2 running ipv4-unicast# l3vpn import vpn true
pe2 running ipv4-unicast# .. ..
pe2 running bgp# neighbor 172.16.2.254
pe2 running neighbor 172.16.2.254#! remote-as external
pe2 running neighbor 172.16.2.254# address-family ipv4-unicast nexthop-self
pe3 running config# / vrf main routing bgp
pe3 running bgp#! as 65000
pe3 running bgp# router-id 192.168.0.3
pe3 running bgp# neighbor 192.168.0.102
pe3 running neighbor 192.168.0.102#! remote-as internal
pe3 running neighbor 192.168.0.102# update-source 192.168.0.3
pe3 running neighbor 192.168.0.102# address-family ipv4-unicast enabled false
pe3 running neighbor 192.168.0.102# address-family ipv4-vpn
pe3 running ipv4-vpn# enabled true
pe3 running ipv4-vpn# soft-reconfiguration-inbound true
pe3 running ipv4-vpn# / vrf main l3vrf RED routing bgp
pe3 running bgp# ebgp-requires-policy false
pe3 running bgp# address-family ipv4-unicast
pe3 running ipv4-unicast# l3vpn export label auto
pe3 running ipv4-unicast# l3vpn export route-distinguisher 65000:1
pe3 running ipv4-unicast# l3vpn export route-target 65000:100
pe3 running ipv4-unicast# l3vpn export vpn true
pe3 running ipv4-unicast# l3vpn import route-target 65000:100
pe3 running ipv4-unicast# l3vpn import vpn true
pe3 running ipv4-unicast# .. ..
pe3 running bgp# neighbor 172.16.3.254
pe3 running neighbor 172.16.3.254#! remote-as external
pe3 running neighbor 172.16.3.254# address-family ipv4-unicast nexthop-self
pe3 running nexthop-self# / vrf main l3vrf BLUE routing bgp
pe3 running bgp# ebgp-requires-policy false
pe3 running bgp# address-family ipv4-unicast
pe3 running ipv4-unicast# l3vpn export label auto
pe3 running ipv4-unicast# l3vpn export route-distinguisher 65000:2
pe3 running ipv4-unicast# l3vpn export route-target 65000:101
pe3 running ipv4-unicast# l3vpn export vpn true
pe3 running ipv4-unicast# l3vpn import route-target 65000:101
pe3 running ipv4-unicast# l3vpn import vpn true
pe3 running ipv4-unicast# .. ..
pe3 running bgp# neighbor 172.16.4.254
pe3 running neighbor 172.16.4.254#! remote-as external
pe3 running neighbor 172.16.4.254# address-family ipv4-unicast nexthop-self
rr1 running config# / vrf main routing bgp
rr1 running bgp#! as 65000
rr1 running bgp# router-id 192.168.0.101
rr1 running bgp# neighbor-group PEERS
rr1 running neighbor-group PEERS# remote-as internal
rr1 running neighbor-group PEERS# update-source 192.168.0.101
rr1 running neighbor-group PEERS# address-family ipv4-unicast enabled false
rr1 running neighbor-group PEERS# address-family ipv4-vpn
rr1 running ipv4-vpn# enabled true
rr1 running ipv4-vpn# route-reflector-client true
rr1 running ipv4-vpn# soft-reconfiguration-inbound true
rr1 running ipv4-vpn# .. .. ..
rr1 running bgp# neighbor 192.168.0.1 neighbor-group PEERS
rr1 running bgp# neighbor 192.168.0.2 neighbor-group PEERS
rr1 running bgp# neighbor 192.168.0.102 neighbor-group PEERS
rr2 running config# / vrf main routing bgp
rr2 running bgp#! as 65000
rr2 running bgp# router-id 192.168.0.102
rr2 running bgp# neighbor-group PEERS
rr2 running neighbor-group PEERS# remote-as internal
rr2 running neighbor-group PEERS# update-source 192.168.0.102
rr2 running neighbor-group PEERS# address-family ipv4-unicast enabled false
rr2 running neighbor-group PEERS# address-family ipv4-vpn
rr2 running ipv4-vpn# enabled true
rr2 running ipv4-vpn# route-reflector-client true
rr2 running ipv4-vpn# soft-reconfiguration-inbound true
rr2 running ipv4-vpn# .. .. ..
rr2 running bgp# neighbor 192.168.0.3 neighbor-group PEERS
rr2 running bgp# neighbor 192.168.0.101 neighbor-group PEERS
ce1 running config# / vrf main routing bgp
ce1 running bgp#! as 65501
ce1 running bgp# router-id 172.16.1.254
ce1 running bgp# ebgp-requires-policy false
ce1 running bgp# address-family ipv4-unicast
ce1 running ipv4-unicast# network 172.20.1.0/24
ce1 running network 172.20.1.0/24# .. .. ..
ce1 running bgp# neighbor 172.16.1.1
ce1 running neighbor 172.16.1.1#! remote-as external
ce1 running neighbor 172.16.1.1# address-family ipv4-unicast
ce1 running ipv4-unicast# nexthop-self
ce2 running config# / vrf main routing bgp
ce2 running bgp#! as 65502
ce2 running bgp# router-id 172.16.2.254
ce2 running bgp# ebgp-requires-policy false
ce2 running bgp# address-family ipv4-unicast
ce2 running ipv4-unicast# network 172.20.2.0/24
ce2 running network 172.20.2.0/24# .. .. ..
ce2 running bgp# neighbor 172.16.2.1
ce2 running neighbor 172.16.2.1#! remote-as external
ce2 running neighbor 172.16.2.1# address-family ipv4-unicast
ce2 running ipv4-unicast# nexthop-self
ce3 running config# / vrf main routing bgp
ce3 running bgp#! as 65503
ce3 running bgp# router-id 172.16.3.254
ce3 running bgp# ebgp-requires-policy false
ce3 running bgp# address-family ipv4-unicast
ce3 running ipv4-unicast# network 172.20.3.0/24
ce3 running network 172.20.3.0/24# .. .. ..
ce3 running bgp# neighbor 172.16.3.1
ce3 running neighbor 172.16.3.1#! remote-as external
ce3 running neighbor 172.16.3.1# address-family ipv4-unicast
ce3 running ipv4-unicast# nexthop-self
ce4 running config# / vrf main routing bgp
ce4 running bgp#! as 65504
ce4 running bgp# router-id 172.16.4.254
ce4 running bgp# ebgp-requires-policy false
ce4 running bgp# address-family ipv4-unicast
ce4 running ipv4-unicast# network 172.20.4.0/24
ce4 running network 172.20.4.0/24# .. .. ..
ce4 running bgp# neighbor 172.16.4.1
ce4 running neighbor 172.16.4.1#! remote-as external
ce4 running neighbor 172.16.4.1# address-family ipv4-unicast
ce4 running ipv4-unicast# nexthop-self
BGP IPv4 VPN is considered converged when rr1 and rr2 have three and two established neighbors, respectively.
rr1> show bgp ipv4 summary
IPv4 VPN Summary:
BGP router identifier 192.168.0.101, local AS number 65000 VRF default vrf-id 0
BGP table version 0
RIB entries 3, using 288 bytes of memory
Peers 3, using 83 KiB of memory
Peer groups 1, using 72 bytes of memory
Neighbor V AS LocalAS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc
192.168.0.1 4 65000 65000 4 7 2 0 0 00:00:11 1 4 FRRouting/10.0.3 (frr-10.0-v1.131)
192.168.0.2 4 65000 65000 4 7 2 0 0 00:00:11 1 4 FRRouting/10.0.3 (frr-10.0-v1.131)
192.168.0.102 4 65000 65000 7 7 2 0 0 00:00:09 2 4 FRRouting/10.0.3 (frr-10.0-v1.131)
Total number of neighbors 3
rr2> show bgp ipv4 summary
IPv4 VPN Summary:
BGP router identifier 192.168.0.102, local AS number 65000 VRF default vrf-id 0
BGP table version 0
RIB entries 3, using 288 bytes of memory
Peers 2, using 55 KiB of memory
Peer groups 1, using 72 bytes of memory
Neighbor V AS LocalAS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc
192.168.0.3 4 65000 65000 5 7 2 0 0 00:00:09 2 4 FRRouting/10.0.3 (frr-10.0-v1.131)
192.168.0.101 4 65000 65000 7 7 2 0 0 00:00:09 2 4 FRRouting/10.0.3 (frr-10.0-v1.131)
Total number of neighbors 2
ce1 and ce3 are connected to L3VRF RED on pe1 and pe3, respectively, while
ce2 and ce4 are connected to L3VRF BLUE on pe2 and pe3, respectively.
pe1> show bgp ipv4 unicast summary l3vrf RED
BGP router identifier 192.168.0.1, local AS number 65000 VRF RED vrf-id 7
BGP table version 2
RIB entries 3, using 288 bytes of memory
Peers 1, using 28 KiB of memory
Neighbor V AS LocalAS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc
172.16.1.254 4 65501 65000 5 5 2 0 0 00:00:08 1 2 N/A
Total number of neighbors 1
pe2> show bgp ipv4 unicast summary l3vrf BLUE
BGP router identifier 192.168.0.2, local AS number 65000 VRF BLUE vrf-id 7
BGP table version 2
RIB entries 3, using 288 bytes of memory
Peers 1, using 28 KiB of memory
Neighbor V AS LocalAS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc
172.16.2.254 4 65502 65000 5 5 2 0 0 00:00:06 1 2 N/A
Total number of neighbors 1
pe3> show bgp ipv4 unicast summary l3vrf RED
BGP router identifier 192.168.0.3, local AS number 65000 VRF RED vrf-id 8
BGP table version 2
RIB entries 3, using 288 bytes of memory
Peers 1, using 28 KiB of memory
Neighbor V AS LocalAS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc
172.16.3.254 4 65503 65000 5 5 2 0 0 00:00:06 1 2 N/A
Total number of neighbors 1
pe3> show bgp ipv4 unicast summary l3vrf BLUE
BGP router identifier 192.168.0.3, local AS number 65000 VRF BLUE vrf-id 7
BGP table version 2
RIB entries 3, using 288 bytes of memory
Peers 1, using 28 KiB of memory
Neighbor V AS LocalAS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc
172.16.4.254 4 65504 65000 5 5 2 0 0 00:00:06 1 2 N/A
Total number of neighbors 1
ce1 learns the 172.16.3.0/24 subnet from ce3.
ce1> show bgp ipv4 unicast
BGP table version is 2, local router ID is 172.16.1.254, l3vrf id 0
Default local pref 100, local AS 65501
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's l3vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> 172.20.1.0/24 0.0.0.0 0 32768 i
*> 172.20.3.0/24 172.16.1.1 0 0 65000 65503 i
Displayed 2 routes and 2 total paths.
ce1> show ipv4-routes
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, N - NHRP, T - Table
> - selected route, * - FIB route, r - rejected, b - backup
L3VRF default:
C>* 172.16.1.0/24 is directly connected, eth-pe1, 00:00:30
C>* 172.20.1.0/24 is directly connected, eth-lan, 00:00:30
B>* 172.20.3.0/24 [20/0] via 172.16.1.1, eth-pe1, weight 1, 00:00:06
3 routes displayed.
ce2 learns the 172.16.4.0/24 subnet from ce4.
ce2> show bgp ipv4 unicast
BGP table version is 2, local router ID is 172.16.2.254, l3vrf id 0
Default local pref 100, local AS 65502
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's l3vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> 172.20.2.0/24 0.0.0.0 0 32768 i
*> 172.20.4.0/24 172.16.2.1 0 0 65000 65504 i
Displayed 2 routes and 2 total paths.
ce2> show ipv4-routes
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, N - NHRP, T - Table
> - selected route, * - FIB route, r - rejected, b - backup
L3VRF default:
C>* 172.16.2.0/24 is directly connected, eth-pe2, 00:00:31
C>* 172.20.2.0/24 is directly connected, eth-lan, 00:00:31
B>* 172.20.4.0/24 [20/0] via 172.16.2.1, eth-pe2, weight 1, 00:00:07
3 routes displayed.
The BGP IPv4 VPN table on pe1 contains the complete list of prefixes,
including those from L3VRF RED (route distinguisher 65000:100) and
L3VRF BLUE (route distinguisher 65000:101).
pe1> show bgp ipv4 vpn
BGP table version is 2, local router ID is 192.168.0.1, vrf id 0
Default local pref 100, local AS 65000
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 65000:1
*> 172.20.1.0/24 172.16.1.254@7< 0 0 65501 i
*>i172.20.3.0/24 192.168.0.3 0 100 0 65503 i
Route Distinguisher: 65000:2
*>i172.20.2.0/24 192.168.0.2 0 100 0 65502 i
*>i172.20.4.0/24 192.168.0.3 0 100 0 65504 i
Displayed 4 routes and 4 total paths
L3VPN prefixes with the route-target 65000:101 are not useful to pe1, as
this route-target is not imported by any L3VRF on that router. Moreover, pe1
does not need to re-advertise these prefixes: it is neither a route-reflector
nor an ASBR.
pe1> show ipv4-routes l3vrf all
Codes: K - kernel route, C - connected, S - static, R - RIP,
O - OSPF, I - IS-IS, B - BGP, N - NHRP, T - Table
> - selected route, * - FIB route, r - rejected, b - backup
L3VRF RED:
K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 00:00:37
C>* 172.16.1.0/24 is directly connected, eth-ce1, 00:00:37
B>* 172.20.1.0/24 [20/0] via 172.16.1.254, eth-ce1, weight 1, 00:00:14
B> 172.20.3.0/24 [200/0] via 192.168.0.3 (l3vrf default) (recursive), label 144, weight 1, 00:00:09
* via 10.0.1.101, eth-rr1 (l3vrf default), label 19/144, weight 1, 00:00:09
L3VRF default:
I 10.0.1.0/24 [115/20] via 10.0.1.101, eth-rr1 inactive, weight 1, 00:00:58
C>* 10.0.1.0/24 is directly connected, eth-rr1, 00:01:37
I>* 10.0.2.0/24 [115/20] via 10.0.1.101, eth-rr1, label implicit-null, weight 1, 00:00:58
I>* 10.0.3.0/24 [115/30] via 10.0.1.101, eth-rr1, label 18, weight 1, 00:00:58
I>* 10.0.100.0/24 [115/20] via 10.0.1.101, eth-rr1, label implicit-null, weight 1, 00:00:58
C>* 192.168.0.1/32 is directly connected, lo1, 00:01:37
I>* 192.168.0.2/32 [115/30] via 10.0.1.101, eth-rr1, label 17, weight 1, 00:00:56
I>* 192.168.0.3/32 [115/40] via 10.0.1.101, eth-rr1, label 19, weight 1, 00:00:54
I>* 192.168.0.101/32 [115/20] via 10.0.1.101, eth-rr1, label implicit-null, weight 1, 00:00:58
I>* 192.168.0.102/32 [115/30] via 10.0.1.101, eth-rr1, label 20, weight 1, 00:00:58
14 routes displayed.
BGP RT filter configuration¶
BGP RT filter is configured under the ipv4-rtfilter AFI/SAFI and is
enabled on all peerings that currently carry ipv4-vpn prefixes.
pe1 running config# / vrf main routing bgp
pe1 running bgp# neighbor 192.168.0.101
pe1 running neighbor 192.168.0.101# address-family ipv4-rtfilter
pe1 running ipv4-rtfilter# enabled true
pe2 running config# / vrf main routing bgp
pe2 running bgp# neighbor 192.168.0.101
pe2 running neighbor 192.168.0.101# address-family ipv4-rtfilter
pe2 running ipv4-rtfilter# enabled true
pe3 running config# / vrf main routing bgp
pe3 running bgp# neighbor 192.168.0.102
pe3 running neighbor 192.168.0.102# address-family ipv4-rtfilter
pe3 running ipv4-rtfilter# enabled true
rr1 running config# / vrf main routing bgp
rr1 running bgp# neighbor-group PEERS
rr1 running neighbor-group PEERS# address-family ipv4-rtfilter
rr1 running ipv4-rtfilter# enabled true
rr1 running ipv4-rtfilter# route-reflector-client true
rr2 running config# / vrf main routing bgp
rr2 running bgp# neighbor-group PEERS
rr2 running neighbor-group PEERS# address-family ipv4-rtfilter
rr2 running ipv4-rtfilter# enabled true
rr2 running ipv4-rtfilter# route-reflector-client true
The presence of ipv4-rtfilter is indicated by rr1 and rr2 now showing an
additional SAFI entry labeled IPv4 RT Filter in the BGP summary.
rr1> show bgp summary
IPv4 VPN Summary:
BGP router identifier 192.168.0.101, local AS number 65000 VRF default vrf-id 0
BGP table version 0
RIB entries 3, using 288 bytes of memory
Peers 3, using 83 KiB of memory
Peer groups 1, using 72 bytes of memory
Neighbor V AS LocalAS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc
192.168.0.1 4 65000 65000 18 23 8 0 0 00:00:04 1 4 FRRouting/10.0.3 (frr-10.0-v1.131)
192.168.0.2 4 65000 65000 16 22 8 0 0 00:00:04 1 4 FRRouting/10.0.3 (frr-10.0-v1.131)
192.168.0.102 4 65000 65000 25 23 8 0 0 00:00:04 2 4 FRRouting/10.0.3 (frr-10.0-v1.131)
Total number of neighbors 3
IPv4 RT Filter Summary:
BGP router identifier 192.168.0.101, local AS number 65000 VRF default vrf-id 0
BGP table version 2
RIB entries 3, using 288 bytes of memory
Peers 3, using 83 KiB of memory
Peer groups 1, using 72 bytes of memory
Neighbor V AS LocalAS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc
192.168.0.1 4 65000 65000 18 23 2 0 0 00:00:04 1 2 FRRouting/10.0.3 (frr-10.0-v1.131)
192.168.0.2 4 65000 65000 16 22 2 0 0 00:00:04 1 2 FRRouting/10.0.3 (frr-10.0-v1.131)
192.168.0.102 4 65000 65000 25 23 2 0 0 00:00:04 0 2 FRRouting/10.0.3 (frr-10.0-v1.131)
Total number of neighbors 3
rr2> show bgp summary
IPv4 VPN Summary:
BGP router identifier 192.168.0.102, local AS number 65000 VRF default vrf-id 0
BGP table version 0
RIB entries 3, using 288 bytes of memory
Peers 2, using 55 KiB of memory
Peer groups 1, using 72 bytes of memory
Neighbor V AS LocalAS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc
192.168.0.3 4 65000 65000 18 27 8 0 0 00:00:02 2 4 FRRouting/10.0.3 (frr-10.0-v1.131)
192.168.0.101 4 65000 65000 23 25 8 0 0 00:00:03 2 4 FRRouting/10.0.3 (frr-10.0-v1.131)
Total number of neighbors 2
IPv4 RT Filter Summary:
BGP router identifier 192.168.0.102, local AS number 65000 VRF default vrf-id 0
BGP table version 4
RIB entries 3, using 288 bytes of memory
Peers 2, using 55 KiB of memory
Peer groups 1, using 72 bytes of memory
Neighbor V AS LocalAS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc
192.168.0.3 4 65000 65000 18 27 4 0 0 00:00:02 2 2 FRRouting/10.0.3 (frr-10.0-v1.131)
192.168.0.101 4 65000 65000 23 25 4 0 0 00:00:03 2 2 FRRouting/10.0.3 (frr-10.0-v1.131)
Total number of neighbors 2
The IPv4 rtfilter BGP table on rr1 contains prefixes advertised by the
PE devices. Each PE router build one prefix for each imported route-target
(ie. configured with the l3vpn import route-target command).
rr1> show bgp ipv4 rtfilter
BGP table version is 2, local router ID is 192.168.0.101, l3vrf id 0
Default local pref 100, local AS 65000
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's l3vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*>i65000:0:2:65000:100/96 100 0 i
*>i65000:0:2:65000:101/96 100 0 i
Displayed 2 prefixes.
These prefixes are special prefixes in the sense they does not contain routes
information to be installed in the RIB but are used for controlling
route-target subscriptions. The prefix itselfs embeds multiple information from left to right:
the origin AS, the route-target Extended Community type and sub-type and the route-target
itself. For example, the prefix 65000:0:2:65000:100/96 has to be read as follows:
Origin AS:
65000Route-target Extended Community type:
0x00(Two-Octet AS-Specific) and sub-type:0x02(Route-Target)Route-Target:
65000:100Prefix length:
96
The route-target value represents a router’s intent to receive prefixes that carry this route-target in their attributes. When a router receives such a prefix from a neighbor, it understands that it should announce all matching prefixes (including that route-target) to the neighbor.
If the same RT is received from multiple internal neighbors (i.e., via iBGP), the router considers all paths valid and announces the matching prefixes to each of them, as long as standard BGP announcement rules are respected. The case of external neighbors is explained later in the document.
In practice, routers that support RT filtering maintain a dedicated per-neighbor RT prefix-list. This list contains all route-targets the neighbor has subscribed to. During BGP L3VPN update processing, this prefix-list is used to determine whether a given prefix should be advertised to that neighbor, based on its route-target attributes.
This list is visible through diagnostic commands. In this setup:
pe1 and pe3 advertise to rr1 and rr2, respectively, that they are interested in prefixes with the
65000:100RT.pe2 and pe3 advertise interest in prefixes with the
65000:101RT.
rr1> show bgp ipv4 rtfilter neighbor 192.168.0.1 prefix-list
RTC prefix-list for peer router-ID 192.168.0.1: 1 entries
RT:65000:100/96 from origin ASNs:
65000
rr1> show bgp ipv4 rtfilter neighbor 192.168.0.2 prefix-list
RTC prefix-list for peer router-ID 192.168.0.2: 1 entries
RT:65000:101/96 from origin ASNs:
65000
rr2> show bgp ipv4 rtfilter neighbor 192.168.0.3 prefix-list
RTC prefix-list for peer router-ID 192.168.0.3: 2 entries
RT:65000:100/96 from origin ASNs:
65000
RT:65000:101/96 from origin ASNs:
65000
RT filter prefixes can range from 0 to 96 bits in length. The prefix length determines the granularity of the route-target subscription. A prefix length of 96 indicates a subscription to a specific route-target. A length of 0 indicates a request to receive all L3VPN prefixes, regardless of their route-target.
Although RT filter prefixes include an Origin AS field encoded on 32 bits, it is not used for filtering. Therefore, the effective variable portion of the route-target prefix length ranges between 32 and 96 bits. For example:
65000:0:2:65000:0/48matches all route-targets with a global administrator value of 65000, regardless of the local administrator.65000:0:2:65000:64/90matches route-targets with a global administrator of 65000 and a local administrator value in the range 64-127.
The PE routers now receive only the prefixes relevant to their
configured L3VRFs. pe1 receives routes for L3VRF RED but not for BLUE.
pe2 receives routes for BLUE but not RED. pe3, which is configured with both
L3VRFs, receives all routes, both RED and BLUE.
pe1> show bgp ipv4 vpn
BGP table version is 4, local router ID is 192.168.0.1, vrf id 0
Default local pref 100, local AS 65000
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 65000:1
*> 172.20.1.0/24 172.16.1.254@7< 0 0 65501 i
*>i172.20.3.0/24 192.168.0.3 0 100 0 65503 i
Displayed 2 routes and 2 total paths
pe2> show bgp ipv4 vpn
BGP table version is 4, local router ID is 192.168.0.2, vrf id 0
Default local pref 100, local AS 65000
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 65000:2
*> 172.20.2.0/24 172.16.2.254@7< 0 0 65502 i
*>i172.20.4.0/24 192.168.0.3 0 100 0 65504 i
Displayed 2 routes and 2 total paths
pe3> show bgp ipv4 vpn
BGP table version is 4, local router ID is 192.168.0.3, vrf id 0
Default local pref 100, local AS 65000
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 65000:1
*>i172.20.1.0/24 192.168.0.1 0 100 0 65501 i
*> 172.20.3.0/24 172.16.3.254@8< 0 0 65503 i
Route Distinguisher: 65000:2
*>i172.20.2.0/24 192.168.0.2 0 100 0 65502 i
*> 172.20.4.0/24 172.16.4.254@7< 0 0 65504 i
Displayed 4 routes and 4 total paths
The following output confirms that the filtered prefixes are no longer received by the PEs, indicating that their absence is due to upstream filtering - not local suppression, such as would occur with the bgp no-retain option.
pe1> show bgp ipv4 vpn neighbor 192.168.0.101 received-routes
BGP table version is 4, local router ID is 192.168.0.1, vrf id 0
Default local pref 100, local AS 65000
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 65000:1
*> 172.20.1.0/24 192.168.0.1 0 100 0 65501 i
*> 172.20.3.0/24 192.168.0.3 0 100 0 65503 i
Total number of prefixes 2
Coexistence with non-RT filter peers¶
The following rules are applied to ensure backward compatibility with non-RT filter peers.
If a neighbor has not negotiated RT filter capability, prefixes will be announced to it without filtering.
A PE receive its own RT filter prefixes back from the route-reflector. Consequently, it includes these reflected prefixes its RT prefix-list for the route-reflector neighbor. As a result, the router will always advertise its L3VPN prefixes to the route-reflector, even if no other router within the AS has subscribed to its route-target. It helps handling cases where a non RT filter peer is connected to the route-reflector.
Rules for external peers¶
The setup described on this page focuses on internal peers. RT filter behavior differs when applied between eBGP peers.
As previously explained, a router considers all paths received from internal peers for a given route-target. However, this is not the case for external peers. When the same RT is received from multiple external neighbors (i.e., via eBGP), the standard BGP best path selection process is used to choose a single best path. In such cases, prefixes matching that route-target are advertised only to the neighbor associated with the best path for the corresponding RT filter prefix.
RT filter best-path selection¶
Application of the best-path selection process¶
An RT filter BGP table is constructed using the standard best path selection process, which chooses the optimal path for each unique prefix. This process is independent from the construction of the per-neighbor RT prefix-list, which determines which L3VPN prefixes are advertised to each peer. The best path selection ensures that only a single instance of each RT filter prefix is retained in the BGP table. This prevents duplicate entries and avoids redundant advertisements.
Role of the originator AS within the prefix itself¶
While each RT filter prefix includes the originator AS as part of its encoding, this field is not used in route-target matching during prefix announcements. Instead, it serves to disambiguate cases where the same RT subscription is received from multiple autonomous systems. Without the originator AS field, a router would retain only one of the subscriptions and discard the others, causing some intended neighbors to be excluded from the announcements.
RT prefix from route-reflector clients and non-clients¶
According to RFC 4456, a route-reflector must reflect a prefix received from a non-client iBGP peer only to its client peers. In contrast, a prefix received from a client must be reflected to all peers, regardless of their client status.
This behavior introduces a potential issue when applied to RT filter prefixes. If the same RT prefix is received from both client and non-client peers, and the standard BGP best path selection chooses the non-client path, the prefix will not be reflected to other non-client peers. As a result, those non-client peers would not learn that one or more route-reflector clients are subscribed to L3VPN prefixes associated with the given RT.
To prevent this issue, an additional priority rule applies specifically to RT filter prefixes. When a router receives the same RT prefix from both route-reflector clients and non-client internal peers, it prefers a client-originated path in the best path selection process.
By prioritizing paths from route-reflector clients, the router ensures that the RT filter prefix is propagated to all relevant peers—including non-clients - thus maintaining accurate and consistent L3VPN route-target subscriptions across the iBGP topology.
Full setup configuration¶
The following configuration samples show the complete configuration used throughout this page:
pe1> show config fullpath nodefault / vrf
/ vrf main
/ vrf main l3vrf RED
/ vrf main l3vrf RED table-id 1001
/ vrf main l3vrf RED interface
/ vrf main l3vrf RED interface physical eth-ce1
/ vrf main l3vrf RED interface physical eth-ce1 ipv4
/ vrf main l3vrf RED interface physical eth-ce1 ipv4 address 172.16.1.1/24
/ vrf main l3vrf RED interface physical eth-ce1 port pci-b0s5
/ vrf main l3vrf RED routing
/ vrf main l3vrf RED routing bgp
/ vrf main l3vrf RED routing bgp ebgp-requires-policy false
/ vrf main l3vrf RED routing bgp address-family
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn export
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn export vpn true
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn export label auto
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn export route-target 65000:100
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn export route-distinguisher 65000:1
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn import
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn import vpn true
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn import route-target 65000:100
/ vrf main l3vrf RED routing bgp neighbor 172.16.1.254
/ vrf main l3vrf RED routing bgp neighbor 172.16.1.254 remote-as external
/ vrf main l3vrf RED routing bgp neighbor 172.16.1.254 address-family
/ vrf main l3vrf RED routing bgp neighbor 172.16.1.254 address-family ipv4-unicast
/ vrf main l3vrf RED routing bgp neighbor 172.16.1.254 address-family ipv4-unicast nexthop-self
/ vrf main interface
/ vrf main interface physical eth-rr1
/ vrf main interface physical eth-rr1 ipv4
/ vrf main interface physical eth-rr1 ipv4 address 10.0.1.1/24
/ vrf main interface physical eth-rr1 port pci-b0s4
/ vrf main interface loopback lo1
/ vrf main interface loopback lo1 ipv4
/ vrf main interface loopback lo1 ipv4 address 192.168.0.1/32
/ vrf main routing
/ vrf main routing interface eth-rr1
/ vrf main routing interface eth-rr1 isis
/ vrf main routing interface eth-rr1 isis area-tag 1
/ vrf main routing interface eth-rr1 isis ipv4-routing true
/ vrf main routing interface eth-rr1 isis network-point-to-point true
/ vrf main routing interface lo1
/ vrf main routing interface lo1 isis
/ vrf main routing interface lo1 isis area-tag 1
/ vrf main routing interface lo1 isis ipv4-routing true
/ vrf main routing interface lo1 isis passive true
/ vrf main routing mpls
/ vrf main routing mpls ldp
/ vrf main routing mpls ldp router-id 192.168.0.1
/ vrf main routing mpls ldp address-family
/ vrf main routing mpls ldp address-family ipv4
/ vrf main routing mpls ldp address-family ipv4 discovery
/ vrf main routing mpls ldp address-family ipv4 discovery transport-address 192.168.0.1
/ vrf main routing mpls ldp address-family ipv4 interface eth-rr1
/ vrf main routing bgp
/ vrf main routing bgp as 65000
/ vrf main routing bgp router-id 192.168.0.1
/ vrf main routing bgp neighbor 192.168.0.101
/ vrf main routing bgp neighbor 192.168.0.101 remote-as internal
/ vrf main routing bgp neighbor 192.168.0.101 update-source 192.168.0.1
/ vrf main routing bgp neighbor 192.168.0.101 address-family
/ vrf main routing bgp neighbor 192.168.0.101 address-family ipv4-unicast
/ vrf main routing bgp neighbor 192.168.0.101 address-family ipv4-unicast enabled false
/ vrf main routing bgp neighbor 192.168.0.101 address-family ipv4-rtfilter
/ vrf main routing bgp neighbor 192.168.0.101 address-family ipv4-vpn
/ vrf main routing bgp neighbor 192.168.0.101 address-family ipv4-vpn soft-reconfiguration-inbound true
/ vrf main routing isis
/ vrf main routing isis instance 1
/ vrf main routing isis instance 1 is-type level-1
/ vrf main routing isis instance 1 area-address 49.0000.0000.0001.00
pe2> show config fullpath nodefault / vrf
/ vrf main
/ vrf main l3vrf BLUE
/ vrf main l3vrf BLUE table-id 1002
/ vrf main l3vrf BLUE interface
/ vrf main l3vrf BLUE interface physical eth-ce2
/ vrf main l3vrf BLUE interface physical eth-ce2 ipv4
/ vrf main l3vrf BLUE interface physical eth-ce2 ipv4 address 172.16.2.1/24
/ vrf main l3vrf BLUE interface physical eth-ce2 port pci-b0s5
/ vrf main l3vrf BLUE routing
/ vrf main l3vrf BLUE routing bgp
/ vrf main l3vrf BLUE routing bgp ebgp-requires-policy false
/ vrf main l3vrf BLUE routing bgp address-family
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn export
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn export vpn true
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn export label auto
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn export route-target 65000:101
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn export route-distinguisher 65000:2
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn import
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn import vpn true
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn import route-target 65000:101
/ vrf main l3vrf BLUE routing bgp neighbor 172.16.2.254
/ vrf main l3vrf BLUE routing bgp neighbor 172.16.2.254 remote-as external
/ vrf main l3vrf BLUE routing bgp neighbor 172.16.2.254 address-family
/ vrf main l3vrf BLUE routing bgp neighbor 172.16.2.254 address-family ipv4-unicast
/ vrf main l3vrf BLUE routing bgp neighbor 172.16.2.254 address-family ipv4-unicast nexthop-self
/ vrf main interface
/ vrf main interface physical eth-rr1
/ vrf main interface physical eth-rr1 ipv4
/ vrf main interface physical eth-rr1 ipv4 address 10.0.2.2/24
/ vrf main interface physical eth-rr1 port pci-b0s4
/ vrf main interface loopback lo1
/ vrf main interface loopback lo1 ipv4
/ vrf main interface loopback lo1 ipv4 address 192.168.0.2/32
/ vrf main routing
/ vrf main routing interface eth-rr1
/ vrf main routing interface eth-rr1 isis
/ vrf main routing interface eth-rr1 isis area-tag 1
/ vrf main routing interface eth-rr1 isis ipv4-routing true
/ vrf main routing interface eth-rr1 isis network-point-to-point true
/ vrf main routing interface lo1
/ vrf main routing interface lo1 isis
/ vrf main routing interface lo1 isis area-tag 1
/ vrf main routing interface lo1 isis ipv4-routing true
/ vrf main routing interface lo1 isis passive true
/ vrf main routing mpls
/ vrf main routing mpls ldp
/ vrf main routing mpls ldp router-id 192.168.0.2
/ vrf main routing mpls ldp address-family
/ vrf main routing mpls ldp address-family ipv4
/ vrf main routing mpls ldp address-family ipv4 discovery
/ vrf main routing mpls ldp address-family ipv4 discovery transport-address 192.168.0.2
/ vrf main routing mpls ldp address-family ipv4 interface eth-rr1
/ vrf main routing bgp
/ vrf main routing bgp as 65000
/ vrf main routing bgp router-id 192.168.0.2
/ vrf main routing bgp neighbor 192.168.0.101
/ vrf main routing bgp neighbor 192.168.0.101 remote-as internal
/ vrf main routing bgp neighbor 192.168.0.101 update-source 192.168.0.2
/ vrf main routing bgp neighbor 192.168.0.101 address-family
/ vrf main routing bgp neighbor 192.168.0.101 address-family ipv4-unicast
/ vrf main routing bgp neighbor 192.168.0.101 address-family ipv4-unicast enabled false
/ vrf main routing bgp neighbor 192.168.0.101 address-family ipv4-rtfilter
/ vrf main routing bgp neighbor 192.168.0.101 address-family ipv4-vpn
/ vrf main routing bgp neighbor 192.168.0.101 address-family ipv4-vpn soft-reconfiguration-inbound true
/ vrf main routing isis
/ vrf main routing isis instance 1
/ vrf main routing isis instance 1 is-type level-1
/ vrf main routing isis instance 1 area-address 49.0000.0000.0002.00
pe3> show config fullpath nodefault / vrf
/ vrf main
/ vrf main l3vrf BLUE
/ vrf main l3vrf BLUE table-id 1002
/ vrf main l3vrf BLUE interface
/ vrf main l3vrf BLUE interface physical eth-ce4
/ vrf main l3vrf BLUE interface physical eth-ce4 ipv4
/ vrf main l3vrf BLUE interface physical eth-ce4 ipv4 address 172.16.4.1/24
/ vrf main l3vrf BLUE interface physical eth-ce4 port pci-b0s6
/ vrf main l3vrf BLUE routing
/ vrf main l3vrf BLUE routing bgp
/ vrf main l3vrf BLUE routing bgp ebgp-requires-policy false
/ vrf main l3vrf BLUE routing bgp address-family
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn export
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn export vpn true
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn export label auto
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn export route-target 65000:101
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn export route-distinguisher 65000:2
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn import
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn import vpn true
/ vrf main l3vrf BLUE routing bgp address-family ipv4-unicast l3vpn import route-target 65000:101
/ vrf main l3vrf BLUE routing bgp neighbor 172.16.4.254
/ vrf main l3vrf BLUE routing bgp neighbor 172.16.4.254 remote-as external
/ vrf main l3vrf BLUE routing bgp neighbor 172.16.4.254 address-family
/ vrf main l3vrf BLUE routing bgp neighbor 172.16.4.254 address-family ipv4-unicast
/ vrf main l3vrf BLUE routing bgp neighbor 172.16.4.254 address-family ipv4-unicast nexthop-self
/ vrf main l3vrf RED
/ vrf main l3vrf RED table-id 1001
/ vrf main l3vrf RED interface
/ vrf main l3vrf RED interface physical eth-ce3
/ vrf main l3vrf RED interface physical eth-ce3 ipv4
/ vrf main l3vrf RED interface physical eth-ce3 ipv4 address 172.16.3.1/24
/ vrf main l3vrf RED interface physical eth-ce3 port pci-b0s5
/ vrf main l3vrf RED routing
/ vrf main l3vrf RED routing bgp
/ vrf main l3vrf RED routing bgp ebgp-requires-policy false
/ vrf main l3vrf RED routing bgp address-family
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn export
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn export vpn true
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn export label auto
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn export route-target 65000:100
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn export route-distinguisher 65000:1
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn import
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn import vpn true
/ vrf main l3vrf RED routing bgp address-family ipv4-unicast l3vpn import route-target 65000:100
/ vrf main l3vrf RED routing bgp neighbor 172.16.3.254
/ vrf main l3vrf RED routing bgp neighbor 172.16.3.254 remote-as external
/ vrf main l3vrf RED routing bgp neighbor 172.16.3.254 address-family
/ vrf main l3vrf RED routing bgp neighbor 172.16.3.254 address-family ipv4-unicast
/ vrf main l3vrf RED routing bgp neighbor 172.16.3.254 address-family ipv4-unicast nexthop-self
/ vrf main interface
/ vrf main interface physical eth-rr2
/ vrf main interface physical eth-rr2 ipv4
/ vrf main interface physical eth-rr2 ipv4 address 10.0.3.3/24
/ vrf main interface physical eth-rr2 port pci-b0s4
/ vrf main interface loopback lo1
/ vrf main interface loopback lo1 ipv4
/ vrf main interface loopback lo1 ipv4 address 192.168.0.3/32
/ vrf main routing
/ vrf main routing interface eth-rr2
/ vrf main routing interface eth-rr2 isis
/ vrf main routing interface eth-rr2 isis area-tag 1
/ vrf main routing interface eth-rr2 isis ipv4-routing true
/ vrf main routing interface eth-rr2 isis network-point-to-point true
/ vrf main routing interface lo1
/ vrf main routing interface lo1 isis
/ vrf main routing interface lo1 isis area-tag 1
/ vrf main routing interface lo1 isis ipv4-routing true
/ vrf main routing interface lo1 isis passive true
/ vrf main routing mpls
/ vrf main routing mpls ldp
/ vrf main routing mpls ldp router-id 192.168.0.3
/ vrf main routing mpls ldp address-family
/ vrf main routing mpls ldp address-family ipv4
/ vrf main routing mpls ldp address-family ipv4 discovery
/ vrf main routing mpls ldp address-family ipv4 discovery transport-address 192.168.0.3
/ vrf main routing mpls ldp address-family ipv4 interface eth-rr2
/ vrf main routing bgp
/ vrf main routing bgp as 65000
/ vrf main routing bgp router-id 192.168.0.3
/ vrf main routing bgp neighbor 192.168.0.102
/ vrf main routing bgp neighbor 192.168.0.102 remote-as internal
/ vrf main routing bgp neighbor 192.168.0.102 update-source 192.168.0.3
/ vrf main routing bgp neighbor 192.168.0.102 address-family
/ vrf main routing bgp neighbor 192.168.0.102 address-family ipv4-unicast
/ vrf main routing bgp neighbor 192.168.0.102 address-family ipv4-unicast enabled false
/ vrf main routing bgp neighbor 192.168.0.102 address-family ipv4-rtfilter
/ vrf main routing bgp neighbor 192.168.0.102 address-family ipv4-vpn
/ vrf main routing bgp neighbor 192.168.0.102 address-family ipv4-vpn soft-reconfiguration-inbound true
/ vrf main routing isis
/ vrf main routing isis instance 1
/ vrf main routing isis instance 1 is-type level-1
/ vrf main routing isis instance 1 area-address 49.0000.0000.0003.00
rr1> show config fullpath nodefault / vrf
/ vrf main
/ vrf main interface
/ vrf main interface physical eth-pe1
/ vrf main interface physical eth-pe1 ipv4
/ vrf main interface physical eth-pe1 ipv4 address 10.0.1.101/24
/ vrf main interface physical eth-pe1 port pci-b0s5
/ vrf main interface physical eth-pe2
/ vrf main interface physical eth-pe2 ipv4
/ vrf main interface physical eth-pe2 ipv4 address 10.0.2.101/24
/ vrf main interface physical eth-pe2 port pci-b0s6
/ vrf main interface physical eth-rr2
/ vrf main interface physical eth-rr2 ipv4
/ vrf main interface physical eth-rr2 ipv4 address 10.0.100.101/24
/ vrf main interface physical eth-rr2 port pci-b0s4
/ vrf main interface loopback lo1
/ vrf main interface loopback lo1 ipv4
/ vrf main interface loopback lo1 ipv4 address 192.168.0.101/32
/ vrf main routing
/ vrf main routing interface eth-pe1
/ vrf main routing interface eth-pe1 isis
/ vrf main routing interface eth-pe1 isis area-tag 1
/ vrf main routing interface eth-pe1 isis ipv4-routing true
/ vrf main routing interface eth-pe1 isis network-point-to-point true
/ vrf main routing interface eth-pe2
/ vrf main routing interface eth-pe2 isis
/ vrf main routing interface eth-pe2 isis area-tag 1
/ vrf main routing interface eth-pe2 isis ipv4-routing true
/ vrf main routing interface eth-pe2 isis network-point-to-point true
/ vrf main routing interface eth-rr2
/ vrf main routing interface eth-rr2 isis
/ vrf main routing interface eth-rr2 isis area-tag 1
/ vrf main routing interface eth-rr2 isis ipv4-routing true
/ vrf main routing interface eth-rr2 isis network-point-to-point true
/ vrf main routing interface lo1
/ vrf main routing interface lo1 isis
/ vrf main routing interface lo1 isis area-tag 1
/ vrf main routing interface lo1 isis ipv4-routing true
/ vrf main routing interface lo1 isis passive true
/ vrf main routing mpls
/ vrf main routing mpls ldp
/ vrf main routing mpls ldp router-id 192.168.0.101
/ vrf main routing mpls ldp address-family
/ vrf main routing mpls ldp address-family ipv4
/ vrf main routing mpls ldp address-family ipv4 discovery
/ vrf main routing mpls ldp address-family ipv4 discovery transport-address 192.168.0.101
/ vrf main routing mpls ldp address-family ipv4 interface eth-pe1
/ vrf main routing mpls ldp address-family ipv4 interface eth-pe2
/ vrf main routing mpls ldp address-family ipv4 interface eth-rr2
/ vrf main routing bgp
/ vrf main routing bgp as 65000
/ vrf main routing bgp router-id 192.168.0.101
/ vrf main routing bgp neighbor-group PEERS
/ vrf main routing bgp neighbor-group PEERS remote-as internal
/ vrf main routing bgp neighbor-group PEERS update-source 192.168.0.101
/ vrf main routing bgp neighbor-group PEERS address-family
/ vrf main routing bgp neighbor-group PEERS address-family ipv4-unicast
/ vrf main routing bgp neighbor-group PEERS address-family ipv4-unicast enabled false
/ vrf main routing bgp neighbor-group PEERS address-family ipv4-rtfilter
/ vrf main routing bgp neighbor-group PEERS address-family ipv4-rtfilter route-reflector-client true
/ vrf main routing bgp neighbor-group PEERS address-family ipv4-vpn
/ vrf main routing bgp neighbor-group PEERS address-family ipv4-vpn route-reflector-client true
/ vrf main routing bgp neighbor-group PEERS address-family ipv4-vpn soft-reconfiguration-inbound true
/ vrf main routing bgp neighbor 192.168.0.1
/ vrf main routing bgp neighbor 192.168.0.1 neighbor-group PEERS
/ vrf main routing bgp neighbor 192.168.0.2
/ vrf main routing bgp neighbor 192.168.0.2 neighbor-group PEERS
/ vrf main routing bgp neighbor 192.168.0.102
/ vrf main routing bgp neighbor 192.168.0.102 neighbor-group PEERS
/ vrf main routing isis
/ vrf main routing isis instance 1
/ vrf main routing isis instance 1 is-type level-1
/ vrf main routing isis instance 1 area-address 49.0000.0000.0101.00
rr2> show config fullpath nodefault / vrf
/ vrf main
/ vrf main interface
/ vrf main interface physical eth-pe3
/ vrf main interface physical eth-pe3 ipv4
/ vrf main interface physical eth-pe3 ipv4 address 10.0.3.102/24
/ vrf main interface physical eth-pe3 port pci-b0s5
/ vrf main interface physical eth-rr1
/ vrf main interface physical eth-rr1 ipv4
/ vrf main interface physical eth-rr1 ipv4 address 10.0.100.102/24
/ vrf main interface physical eth-rr1 port pci-b0s4
/ vrf main interface loopback lo1
/ vrf main interface loopback lo1 ipv4
/ vrf main interface loopback lo1 ipv4 address 192.168.0.102/32
/ vrf main routing
/ vrf main routing interface eth-pe3
/ vrf main routing interface eth-pe3 isis
/ vrf main routing interface eth-pe3 isis area-tag 1
/ vrf main routing interface eth-pe3 isis ipv4-routing true
/ vrf main routing interface eth-pe3 isis network-point-to-point true
/ vrf main routing interface eth-rr1
/ vrf main routing interface eth-rr1 isis
/ vrf main routing interface eth-rr1 isis area-tag 1
/ vrf main routing interface eth-rr1 isis ipv4-routing true
/ vrf main routing interface eth-rr1 isis network-point-to-point true
/ vrf main routing interface lo1
/ vrf main routing interface lo1 isis
/ vrf main routing interface lo1 isis area-tag 1
/ vrf main routing interface lo1 isis ipv4-routing true
/ vrf main routing interface lo1 isis passive true
/ vrf main routing mpls
/ vrf main routing mpls ldp
/ vrf main routing mpls ldp router-id 192.168.0.102
/ vrf main routing mpls ldp address-family
/ vrf main routing mpls ldp address-family ipv4
/ vrf main routing mpls ldp address-family ipv4 discovery
/ vrf main routing mpls ldp address-family ipv4 discovery transport-address 192.168.0.102
/ vrf main routing mpls ldp address-family ipv4 interface eth-pe3
/ vrf main routing mpls ldp address-family ipv4 interface eth-rr1
/ vrf main routing bgp
/ vrf main routing bgp as 65000
/ vrf main routing bgp router-id 192.168.0.102
/ vrf main routing bgp neighbor-group PEERS
/ vrf main routing bgp neighbor-group PEERS remote-as internal
/ vrf main routing bgp neighbor-group PEERS update-source 192.168.0.102
/ vrf main routing bgp neighbor-group PEERS address-family
/ vrf main routing bgp neighbor-group PEERS address-family ipv4-unicast
/ vrf main routing bgp neighbor-group PEERS address-family ipv4-unicast enabled false
/ vrf main routing bgp neighbor-group PEERS address-family ipv4-rtfilter
/ vrf main routing bgp neighbor-group PEERS address-family ipv4-rtfilter route-reflector-client true
/ vrf main routing bgp neighbor-group PEERS address-family ipv4-vpn
/ vrf main routing bgp neighbor-group PEERS address-family ipv4-vpn route-reflector-client true
/ vrf main routing bgp neighbor-group PEERS address-family ipv4-vpn soft-reconfiguration-inbound true
/ vrf main routing bgp neighbor 192.168.0.3
/ vrf main routing bgp neighbor 192.168.0.3 neighbor-group PEERS
/ vrf main routing bgp neighbor 192.168.0.101
/ vrf main routing bgp neighbor 192.168.0.101 neighbor-group PEERS
/ vrf main routing isis
/ vrf main routing isis instance 1
/ vrf main routing isis instance 1 is-type level-1
/ vrf main routing isis instance 1 area-address 49.0000.0000.0102.00
ce1> show config fullpath nodefault / vrf
/ vrf main
/ vrf main interface
/ vrf main interface physical eth-lan
/ vrf main interface physical eth-lan ipv4
/ vrf main interface physical eth-lan ipv4 address 172.20.1.1/24
/ vrf main interface physical eth-lan port pci-b0s5
/ vrf main interface physical eth-pe1
/ vrf main interface physical eth-pe1 ipv4
/ vrf main interface physical eth-pe1 ipv4 address 172.16.1.254/24
/ vrf main interface physical eth-pe1 port pci-b0s4
/ vrf main routing
/ vrf main routing bgp
/ vrf main routing bgp as 65501
/ vrf main routing bgp router-id 172.16.1.254
/ vrf main routing bgp ebgp-requires-policy false
/ vrf main routing bgp address-family
/ vrf main routing bgp address-family ipv4-unicast
/ vrf main routing bgp address-family ipv4-unicast network 172.20.1.0/24
/ vrf main routing bgp neighbor 172.16.1.1
/ vrf main routing bgp neighbor 172.16.1.1 remote-as external
/ vrf main routing bgp neighbor 172.16.1.1 address-family
/ vrf main routing bgp neighbor 172.16.1.1 address-family ipv4-unicast
/ vrf main routing bgp neighbor 172.16.1.1 address-family ipv4-unicast nexthop-self
ce2> show config fullpath nodefault / vrf
/ vrf main
/ vrf main interface
/ vrf main interface physical eth-lan
/ vrf main interface physical eth-lan ipv4
/ vrf main interface physical eth-lan ipv4 address 172.20.2.1/24
/ vrf main interface physical eth-lan port pci-b0s5
/ vrf main interface physical eth-pe2
/ vrf main interface physical eth-pe2 ipv4
/ vrf main interface physical eth-pe2 ipv4 address 172.16.2.254/24
/ vrf main interface physical eth-pe2 port pci-b0s4
/ vrf main routing
/ vrf main routing bgp
/ vrf main routing bgp as 65502
/ vrf main routing bgp router-id 172.16.2.254
/ vrf main routing bgp ebgp-requires-policy false
/ vrf main routing bgp address-family
/ vrf main routing bgp address-family ipv4-unicast
/ vrf main routing bgp address-family ipv4-unicast network 172.20.2.0/24
/ vrf main routing bgp neighbor 172.16.2.1
/ vrf main routing bgp neighbor 172.16.2.1 remote-as external
/ vrf main routing bgp neighbor 172.16.2.1 address-family
/ vrf main routing bgp neighbor 172.16.2.1 address-family ipv4-unicast
/ vrf main routing bgp neighbor 172.16.2.1 address-family ipv4-unicast nexthop-self
ce3> show config fullpath nodefault / vrf
/ vrf main
/ vrf main interface
/ vrf main interface physical eth-lan
/ vrf main interface physical eth-lan ipv4
/ vrf main interface physical eth-lan ipv4 address 172.20.3.1/24
/ vrf main interface physical eth-lan port pci-b0s5
/ vrf main interface physical eth-pe3
/ vrf main interface physical eth-pe3 ipv4
/ vrf main interface physical eth-pe3 ipv4 address 172.16.3.254/24
/ vrf main interface physical eth-pe3 port pci-b0s4
/ vrf main routing
/ vrf main routing bgp
/ vrf main routing bgp as 65503
/ vrf main routing bgp router-id 172.16.3.254
/ vrf main routing bgp ebgp-requires-policy false
/ vrf main routing bgp address-family
/ vrf main routing bgp address-family ipv4-unicast
/ vrf main routing bgp address-family ipv4-unicast network 172.20.3.0/24
/ vrf main routing bgp neighbor 172.16.3.1
/ vrf main routing bgp neighbor 172.16.3.1 remote-as external
/ vrf main routing bgp neighbor 172.16.3.1 address-family
/ vrf main routing bgp neighbor 172.16.3.1 address-family ipv4-unicast
/ vrf main routing bgp neighbor 172.16.3.1 address-family ipv4-unicast nexthop-self
ce4> show config fullpath nodefault / vrf
/ vrf main
/ vrf main interface
/ vrf main interface physical eth-lan
/ vrf main interface physical eth-lan ipv4
/ vrf main interface physical eth-lan ipv4 address 172.20.4.1/24
/ vrf main interface physical eth-lan port pci-b0s5
/ vrf main interface physical eth-pe3
/ vrf main interface physical eth-pe3 ipv4
/ vrf main interface physical eth-pe3 ipv4 address 172.16.4.254/24
/ vrf main interface physical eth-pe3 port pci-b0s4
/ vrf main routing
/ vrf main routing bgp
/ vrf main routing bgp as 65504
/ vrf main routing bgp router-id 172.16.4.254
/ vrf main routing bgp ebgp-requires-policy false
/ vrf main routing bgp address-family
/ vrf main routing bgp address-family ipv4-unicast
/ vrf main routing bgp address-family ipv4-unicast network 172.20.4.0/24
/ vrf main routing bgp neighbor 172.16.4.1
/ vrf main routing bgp neighbor 172.16.4.1 remote-as external
/ vrf main routing bgp neighbor 172.16.4.1 address-family
/ vrf main routing bgp neighbor 172.16.4.1 address-family ipv4-unicast
/ vrf main routing bgp neighbor 172.16.4.1 address-family ipv4-unicast nexthop-self