28.06.2014 Views

Discussion

Discussion

Discussion

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

aviva@RouterG# set term 1 then community add VPN2<br />

aviva@RouterG# set term 1 then accept<br />

aviva@RouterG# set term 2 then reject<br />

If you need more involved policies, configure them in the [edit policy-options] hierarchy<br />

and apply them to the VPN with the set vrf-import and set vrf-export commands,<br />

specifying the name of your policy. As an example, the following commands<br />

apply the VPN2-import-policy and VPN2-export-policy policies to VPN2:<br />

[edit routing-instances VPN2]<br />

aviva@RouterG# set vrf-import VPN2-import-policy<br />

aviva@RouterG# set vrf-export VPN2-export-policy<br />

Finally, the VPN needs to know how to forward traffic to the CE router at the customer<br />

site. This recipe creates a static route to use for forwarding:<br />

[edit routing-instances VPN2]<br />

aviva@RouterG# set routing-options static route 192.168.13.1/32 next-hop se-5/0/1<br />

You can also use BGP, OSPF, or RIP.<br />

Now let’s verify that the VPN is operational. First, check that you can ping the CE<br />

router:<br />

aviva@RouterG> ping 192.168.13.1 count 5<br />

PING 192.168.13.1 (192.168.13.1): 56 data bytes<br />

^C<br />

--- 192.168.13.1 ping statistics ---<br />

5 packets transmitted, 0 packets received, 100% packet loss<br />

Why does the ping transmission fail if the static route is in the routing table? Let’s<br />

check the routing tables using a different command:<br />

aviva@RouterG> show route 192.168.13.1 protocol static<br />

inet.0: 12 destinations, 13 routes (12 active, 0 holddown, 0 hidden)<br />

+ = Active Route, - = Last Active, * = Both<br />

0.0.0.0/0 *[Static/5] 1w1d 20:56:23<br />

> to 172.19.121.1 via fe-0/0/0.0<br />

VPN2.inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)<br />

+ = Active Route, - = Last Active, * = Both<br />

192.168.13.1/32 *[Static/5] 01:21:55<br />

> via se-5/0/1.0<br />

This command shows that the static route is present in the VPN2.inet.0 routing table<br />

but not in the inet.0 routing table. To ping it, you need to specify the VPN routing<br />

instance in the ping command:<br />

aviva@RouterG> ping 192.168.13.1 count 5 routing-instance VPN2<br />

PING 192.168.13.1 (192.168.13.1): 56 data bytes<br />

64 bytes from 192.168.13.1: icmp_seq=0 ttl=255 time=18.399 ms<br />

64 bytes from 192.168.13.1: icmp_seq=1 ttl=255 time=10.436 ms<br />

64 bytes from 192.168.13.1: icmp_seq=2 ttl=255 time=25.565 ms<br />

64 bytes from 192.168.13.1: icmp_seq=3 ttl=255 time=40.311 ms<br />

64 bytes from 192.168.13.1: icmp_seq=4 ttl=255 time=10.346 ms<br />

562 | Chapter 15: VPNs<br />

This is the Title of the Book, eMatter Edition<br />

Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!