Routing

Hi All,

i need your help please to understand this behavior, i have PE1/PE2/PE3 routers configured with routing instances, i configured bgp peering with inet-vpn unicast family and inet, now i have saparate export policies, one for BGP inet configured directly under the neighbor, and other export is vrf export policy with from bgp/static/direct add community! 

the problem when i add next-hop-self export policy under BGP neighbor, the VRF export routes he learned from other PE within the same VRF and advertise them making himself the next hop! i want only the regular ipv4 routes to have next-hop-self option only, but it didnt work with me at all..when i remove next-hop-self from bgp, vrf exports as it should! i'm sure that i'm missing something here! can someone guide me please to understand this behavior.

also i found this on Juniper site regarding vpn-apply-export command! it really confused me, can someone help me to understand it on other words.. 

""When you apply a VRF export policy as described in Configuring an Export Policy for the PE Router’s VRF Table, routes from VPN routing instances are advertised to other PE routers based on this policy, whereas the BGP export policy is ignored."""

Thank you in advance

Hi,

I am not sure how you have configured the next hop self policy, but it sounds like you are mathcing all bgp routes, both internal and external. When you apply nhs you do not want to match internal bgp learnt routes, you can use something like this to match external bgp routes only.

set policy-options policy-statement nhs term 1 from protocol bgp
set policy-options policy-statement nhs term 1 from route-type external
set policy-options policy-statement nhs term 1 then next-hop-self

Attach your configuration if you need further help.

Tim

Thanks Tim for your kind help, well please find attached Juniper Router config acting as RR, and other end PE is cisco along with the diagram..

i solved the problem by adding from family inet to the next hop policy like below, but what is confusing me! is it normal for export policy applied on BGP group to effect vrf?

policy-statement bgp-nhs {
term 1 {
from {
family inet;
protocol bgp;
}
then {
next-hop self;
}
}
}

Attachment(s)

BUS-PE.txt   3 KB 1 version

JU-PE.txt   4 KB 1 version

answering your policy, i dont have any external routes (eBGP) if that what you mean!

Hi,

the JUNOS default behaviour is that

- the normal BGP export policy bound under the BGP neighbor deals with all non-VPN routes (inet, inet6, ...)

- the export policies bound under vrf-export within the routing-instance are only applied to VRF-specific routes (inet-vpn, inet6-vpn) and bypasses the neighbor-based export policy

By configuring the option "vpn-apply-export", you force that the VPN-specific routes are also handled by the neighbor-based export policies. So, by removing "vpn-apply-export" statement, you will get the behaviour you expect.

Cheers,

Carsten

Hi Carsten,

Thanks for your input in this matter, let me summarize

((when i set the command vpn-apply-export --> next hop (which is configured under BGP) will be applied to my VRF Export routes))

now what i'm facing is.. that i didnt configure vpn-apply-export (as you can see in the config i posted) and next-hop-self is set on my VRF routes! i solved that by adding (from family inet)

so what is happening with me is the exact opposite of what you said, or i'm still lost here!

Tariq

Now, I am confused. The JU-PE.txt which you have attached includes the "vpn-apply-export" command.

<snip>

protocols {
    bgp {
        group 1 {
            type internal;
            family inet {
                unicast;
            }
            export [ bgp-export-local-routes bgp-nhs ];
            vpn-apply-export;                 <----------------------
            neighbor 100.1.1.99 {
                local-address 100.1.1.1;
                peer-as 100;
            }

Cheers,

Carsten

yes sorry for that, it seems i copied the config while its there, but the cisco output is without it, this issue happened with me before i even know that there is that command in Junos 🙂 

Anyway i already have case with JTAC for the same issue, and they still didnt answer me too, i will update you all once i get their feedback.

new screen shots wihtout the vpn-apply-export command.. or from family inet in next-hop-self policy