Cisco ASR 9000 Series Routing Configuration Guide

PE device where a VRF-based CE is configured as iBGP. This eliminates the need for service providers (SPs)
to configure autonomous system override for the CE. With this feature enabled, there is no need to configure
the virtual private network (VPN) sites using different autonomous systems.
The neighbor internal-vpn-client command enables PE devices to make an entire VPN cloud act as an
internal VPN client to the CE devices. These CE devices are connected internally to the VPN cloud through
the iBGP PE-CE connection inside the VRF. After this connection is established, the PE device encapsulates
the CE-learned path into an attribute called ATTR_SET and carries it in the iBGP-sourced path throughout
the VPN core to the remote PE device. At the remote PE device, this attribute is assigned with individual
attributes and the source CE path is extracted and sent to the remote CE devices.
ATTR_SET is an optional transitive attribute that carries the CE path attributes received. The ATTR_SET
attribute is encoded inside the BGP update message as follows:
+------------------------------+
| Attr Flags (O|T) Code = 128 |
+------------------------------+
| Attr. Length (1 or 2 octets) |
+------------------------------+
| Origin AS (4 octets) |
+------------------------------+
| Path attributes (variable) |
+------------------------------+
Origin AS is the AS of the VPN customer for which the ATTR_SET is generated. The minimum length of
ATTR_SET is four bytes and the maximum is the maximum supported for a path attribute after taking into
consideration the mandatory fields and attributes in the BGP update message. It is recommended that the
maximum length is limited to 3500 bytes. ATTR_SET must not contain the following attributes: MP_REACH,
MP_UNREACH, NEW_AS_PATH, NEW_AGGR, NEXT_HOP and ATTR_SET itself (ATTR_SET inside
ATTR_SET). If these attributes are found inside the ATTR_SET, the ATTR_SET is considered invalid and
the corresponding error handling mechanism is invoked.
Restrictions for L3VPN iBGP PE-CE
The following restrictions apply to configuring L3VPN iBGP PE-CE:
•
When the iBGP PE CE feature is toggled and the neighbor no longer supports route-refresh or
soft-reconfiguration inbound, a manual session flap must be done to see the change. When this occurs,
the following message is displayed:
RP/0/0/CPU0: %ROUTING-BGP-5-CFG_CHG_RESET: Internal VPN client configuration change on
neighbor 10.10.10.1 requires HARD reset
(clear bgp 10.10.10.1) to take effect.
•
iBGP PE CE CLI configuration is not available for peers under default-VRF, except for
neighbor/session-group.
•
This feature does not work on regular VPN clients (eBGP VPN clients).
•
Attributes packed inside the ATTR_SET reflects changes made by the inbound route-policy on the iBGP
CE and does not reflect the changes made by the export route-policy for the specified VRF.
•
Different VRFs of the same VPN (that is, in different PE routers) that are configured with iBGP PE-CE
peering sessions must use different Route Distinguisher (RD) values under respective VRFs. The iBGP
PE CE feature does ot work if the RD values are the same for the ingress and egress VRF.
Cisco ASR 9000 Series Aggregation Services Router Routing Configuration Guide, Release 5.3.x
132
Implementing BGP
L3VPN iBGP PE-CE

Cisco ASR 9000 Series Specifications

General

Brand	Cisco
Model	ASR 9000 Series
Category	Network Router
Language	English