1.1.1 利用L3×××组建Intranet
1. 组网需求
两个企业分别通过MPLS网络组建两个×××:×××_A和×××_B。
CE1、CE3属于×××_A,CE2、CE4属于×××_B。属于同一个×××的用户可以互通,不属于同一个×××的用户不能互通。在下图中,CE1和CE3能互相访问,CE2和CE4能互相访问。CE1和CE2、CE4不能互访,CE2不能和CE1、CE3互访。
PE为Quidway NE系列路由器,P为能运行MPLS的Quidway NE路由器,CE为一般的Quidway系列中低端路由器。
2. 组网图
L3 ×××的关键是让CE之间能互相学习到私网路由,并能根据学习到的私网路由在公网上转发报文。
为了能让私网路由发布到远端CE,需要首先将本地CE的私网路由传递到本地PE,然后再由本地PE发布到远端PE,最后由远端PE传递到远端CE。PE、CE之间的私网路由传递可以通过CE和PE之间建立M-EBGP邻居、扩展RIP以及配置静态路由等方式来实现(本配置例采用M-EBGP方式)。PE之间的私网路由传递需要通过建立M-IBGP邻居来实现;
为了能让私网流量在公网上转发报文,需要在PE、P之间建立MPLS LDP邻居并建立LSP隧道,这样,私网流量就通过隧道在公网上转发了。
1) 配置PE路由器、P路由器上的MPLS基本能力,使他们能为私网流量建立LSP隧道
2) 在PE路由器上配置×××实例,并绑定在和CE相连的端口上
3) 配置PE路由器、P路由器上的IGP协议(本测试例采用OSPF),使他们能相互学习到其他路由器上的路由,尤其是Loopback地址的路由。因为PE之间的M-IBGP邻居必须通过Loopback接口来建立,
4) 配置M-BGP协议,包括PE之间的IBGP邻居以及PE和CE之间的EBGP邻居。
1) 配置PE路由器、P路由器上的MPLS基本能力,使他们能为私网路由建立LSP隧道
配置要点:因为LSR标识相同的路由器无法建立MPLS LDP邻居,所以各路由器的LSR标识必须互不相同,
PE1配置
# 配置MPLS基本能力,PE1的LSR标识为172.1.1.1。
<PE1> system-view
[PE1] mpls lsr-id 172.1.1.1
[PE1] mpls ldp
[PE1-mpls-ldp] quit
# 在与P相连的接口上使能LDP。
[PE1] interface pos2/0/0
[PE1-Pos2/0/0] undo shut
[PE1-Pos2/0/0] ip address 172.1.1.1 255.255.0.0
[PE1-pos2/0/0] mpls ldp enable
[PE1-pos2/0/0] quit
# 配置MPLS基本能力,PE1的LSR标识为172.2.2.2。
<PE2> system-view
[PE2] mpls lsr-id 172.2.2.2
[PE2] mpls ldp
[PE2-mpls-ldp] quit
# 在与P相连的接口上配置IP地址,并使能LDP。
[PE2] interface pos 2/0/0
[PE2-Pos2/0/0] undo shut
[PE2-Pos2/0/0] ip address 172.2.2.2 255.255.0.0
[PE2-pos2/0/0] mpls ldp enable
[PE2-pos2/0/0] quit
# 配置MPLS基本能力。P路由器LSR标识为172.1.1.2
<P> system-view
[P] mpls lsr-id 172.1.1.2
[P] mpls ldp
[P-mpls-ldp] quit
# 在与PE相连的接口上配置IP地址,并使能LDP。
[P] interface pos2/0/0
[P-Pos2/0/0] undo shut
[P-Pos2/0/0] ip address 172.1.1.2 255.255.0.0
[P-Pos2/0/0] mpls ldp enable
[P-Pos2/0/0] quit
[P] interface pos2/0/1
[P-Pos2/0/1] undo shut
[P-Pos2/0/1] ip address 172.2.2.1 255.255.0.0
[P-Pos2/0/1] mpls ldp enable
[P-Pos2/0/1] quit
PE1上结果:
[PE1]display mpls ldp session
Showing information about all sessions:
Peer LDP ID: 172.1.1.2:0; Local LDP ID: 172.1.1.1:1
Tcp connection:172.1.1.2 - 172.1.1.1
Session State: Operational
Session Role: Passive
Session existed time: 1 minutes 17 seconds
KeepAlive packet sent/received: 4/4
Negotiated value of Keepalive Timer: 60 Peer PV Limit: 0
LDP discovery Interface:Pos2/0/0
[P]display mpls ldp session
Showing information about all sessions:
Peer LDP ID: 172.1.1.1:0; Local LDP ID: 172.1.1.2:1
Tcp connection:172.1.1.1 - 172.1.1.2
Session State: Operational
Session Role: Active
Session existed time: 4 minutes 29 seconds
KeepAlive packet sent/received: 12/12
Negotiated value of Keepalive Timer: 60 Peer PV Limit: 0
LDP discovery Interface:Pos2/0/0
Tcp connection:172.2.2.2 - 172.2.2.1
Session State: Operational
Session Role: Passive
Session existed time: 4 minutes 2 seconds
KeepAlive packet sent/received: 10/10
Negotiated value of Keepalive Timer: 60 Peer PV Limit: 0
LDP discovery Interface:Pos2/0/1
配置要点:×××实例的配置关键在×××-target的配置。×××-target的配置分为Import属性和Export属性。Export为发布私网路由时所带的属性,而Import则是接收远方发布过来的私网路由的依据。如果远方传递过来的私网路由中的Export ×××-Target属性中包含本地×××实例的Import ×××-Target配置中的任何一个(本地可能配置多个Import ×××-Target),则该×××实例就能够接收这条私网路由。在本配置例中,PE1上的vpna的export为100:1,PE2上的vpna的import为100:1和100:3,所以PE2能接收PE1发布的私网路由。
# 创建×××实例vpna。
[PE1] ip vpn-instance vpna
# 配置本vpn-instance的Route Distinguisher。
[PE1-vpn-instance] route-distinguisher 100:1
# 配置本vpn-instance的×××-target。
[PE1-vpn-instance] vpn-target 100:1 both
# 配置CE1所在的Site可以接受CE3所在的Site的路由。
[PE1-vpn-instance] vpn-target 100:3 import-extcommunity
# 创建×××实例vpnb。
[PE1] ip vpn-instance vpnb
# 配置本vpn-instance的Route Distinguisher。
[PE1-vpn-instance] route-distinguisher 100:2
# 配置本vpn-instance的×××-target。
[PE1-vpn-instance] vpn-target 100:2 both
# 配置CE2所在的Site可以接受CE4所在的Site的路由。
[PE1-vpn-instance] vpn-target 100:4 import-extcommunity
[PE1-vpn-instance] quit
# 将vpn-instance和与CE连接的接口关联,并配置与vpn-instance关联的接口地址。
[PE1] interface ethernet 1/0/0
[PE1-Ethernet1/0/0] undo shut
[PE1-Ethernet1/0/0] ip binding vpn-instance vpna
[PE1-Ethernet1/0/0] ip address 168.1.1.1 255.255.0.0
[PE1-Ethernet1/0/0] quit
[PE1] interface ethernet 1/0/1
[PE1-Ethernet1/0/1] undo shut
[PE1-Ethernet1/0/1] ip binding vpn-instance vpnb
[PE1-Ethernet1/0/1] ip address 168.2.2.1 255.255.0.0
[PE1-Ethernet1/0/1] quit
# 配置接口。
<CE1> system-view
[CE1] interface ethernet 1
[CE1-Ethernet1] undo shut
[CE1-Ethernet1] ip address 168.1.1.2 255.255.0.0
[CE1-Ethernet1] quit
# 配置接口。
<CE2> system-view
[CE2] interface ethernet 1
[CE2-Ethernet1] undo shut
[CE2-Ethernet1] ip address 168.2.2.2 255.255.0.0
[CE2-Ethernet1] quit
# 创建×××实例vpna。
[PE2] ip vpn-instance vpna
# 配置本vpn-instance的Route Distinguisher。
[PE2-vpn-instance] route-distinguisher 100:3
# 配置本vpn-instance的×××-target。
[PE2-vpn-instance] vpn-target 100:3 both
# 配置CE3所在的Site可以接受CE1所在的Site的路由。
[PE2-vpn-instance] vpn-target 100:1 import-extcommunity
[PE2-vpn-instance] quit
# 创建×××实例vpnb。
[PE2] ip vpn-instance vpnb
# 配置本vpn-instance的Route Distinguisher。
[PE2-vpn-instance] route-distinguisher 100:4
# 配置本vpn-instance的×××-target。
[PE2-vpn-instance] vpn-target 100:4 both
# 配置CE4所在的Site可以接受CE2所在的Site的路由。
[PE2-vpn-instance] vpn-target 100:2 import-extcommunity
[PE2-vpn-instance] quit
# 将vpn-instance和与CE连接的接口关联,并配置与vpn-instance关联的接口地址。
[PE2] interface ethernet 1/0/0
[PE2-Ethernet1/0/0] undo shut
[PE2-Ethernet1/0/0] ip binding vpn-instance vpna
[PE2-Ethernet1/0/0] ip address 168.3.3.1 255.255.0.0
[PE2-Ethernet1/0/0] quit
[PE2] interface ethernet 1/0/1
[PE2-Ethernet1/0/1] undo shut
[PE2-Ethernet1/0/1] ip binding vpn-instance vpnb
[PE2-Ethernet1/0/1] ip address 168.4.4.1 255.255.0.0
[PE2-Ethernet1/0/1] quit
# 配置接口。
<CE3> system-view
[CE3] interface ethernet 1
[CE3-Ethernet1] undo shut
[CE3-Ethernet1] ip address 168.3.3.2 255.255.0.0
[CE3-Ethernet1] quit
# 配置接口。
<CE4> system-view
[CE4] interface ethernet 1
[CE4-Ethernet1] undo shut
[CE4-Ethernet1] ip address 168.4.4.2 255.255.0.0
[CE4-Ethernet1] quit
[PE1]display ip vpn-instance verbose
×××-Instance : vpna
No description
Route-Distinguisher :
100:1
Interfaces :
Ethernet1/0/0
Export-ext-communities :
100:1
Import-ext-communities :
100:1 100:3
×××-Instance : vpnb
No description
Route-Distinguisher :
100:2
Interfaces :
Ethernet1/0/1
Export-ext-communities :
100:2
Import-ext-communities :
100:2 100:4
PING 168.1.1.2: 56 data bytes, press CTRL_C to break
Reply from 168.1.1.2: bytes=56 Sequence=1 ttl=255 time = 3 ms
Reply from 168.1.1.2: bytes=56 Sequence=2 ttl=255 time = 3 ms
Reply from 168.1.1.2: bytes=56 Sequence=3 ttl=255 time = 3 ms
Reply from 168.1.1.2: bytes=56 Sequence=4 ttl=255 time = 3 ms
Reply from 168.1.1.2: bytes=56 Sequence=5 ttl=255 time = 3 ms
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 3/3/3 ms
PING 168.2.2.2: 56 data bytes, press CTRL_C to break
Reply from 168.2.2.2: bytes=56 Sequence=1 ttl=255 time = 3 ms
Reply from 168.2.2.2: bytes=56 Sequence=2 ttl=255 time = 3 ms
Reply from 168.2.2.2: bytes=56 Sequence=3 ttl=255 time = 3 ms
Reply from 168.2.2.2: bytes=56 Sequence=4 ttl=255 time = 3 ms
Reply from 168.2.2.2: bytes=56 Sequence=5 ttl=255 time = 3 ms
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 3/3/3 ms
[PE2]display ip vpn-instance verbose
×××-Instance : vpna
No description
Route-Distinguisher :
100:3
Interfaces :
GigabitEthernet1/1/0
Export-ext-communities :
100:3
Import-ext-communities :
100:1 100:3
×××-Instance : vpnb
No description
Route-Distinguisher :
100:4
No interfaces
Export-ext-communities :
100:4
Import-ext-communities :
100:2 100:4
PING 168.3.3.2: 56 data bytes, press CTRL_C to break
Reply from 168.3.3.2: bytes=56 Sequence=1 ttl=255 time = 4 ms
Reply from 168.3.3.2: bytes=56 Sequence=2 ttl=255 time = 3 ms
Reply from 168.3.3.2: bytes=56 Sequence=3 ttl=255 time = 3 ms
Reply from 168.3.3.2: bytes=56 Sequence=4 ttl=255 time = 3 ms
Reply from 168.3.3.2: bytes=56 Sequence=5 ttl=255 time = 3 ms
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 3/3/4 ms
PING 168.4.4.2: 56 data bytes, press CTRL_C to break
Reply from 168.4.4.2: bytes=56 Sequence=1 ttl=255 time = 4 ms
Reply from 168.4.4.2: bytes=56 Sequence=2 ttl=255 time = 3 ms
Reply from 168.4.4.2: bytes=56 Sequence=3 ttl=255 time = 3 ms
Reply from 168.4.4.2: bytes=56 Sequence=4 ttl=255 time = 3 ms
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 3/3/4 ms
配置要点:PE上必须配置32位掩码的主机地址的LoopBack接口,必须通过IGP发送给PE对等体
# 配置Loopback接口(对PE路由器,配置Loopback接口地址时,必须使用32位掩码的主机地址)
[PE1] interface loopback0
[PE1-LoopBack 0] ip address 202.100.1.1 255.255.255.255
[PE1-LoopBack 0] quit
# 运行IGP路由协议,本例采用OSPF。
[PE1] ospf
[PE1-ospf] area 0
[PE1-ospf-area-0.0.0.0] network 172.1.1.0 0.0.255.255
[PE1-ospf-area-0.0.0.0] network 202.100.1.1 0.0.0.0
[PE1-ospf-area-0.0.0.0] quit
[PE1-ospf] quit
# 配置Loopback接口(对PE路由器,配置Loopback接口地址时,必须使用32位掩码的主机地址)
[PE2] interface loopback0
[PE2-LoopBack 0] ip address 202.100.1.2 255.255.255.255
[PE2-LoopBack 0] quit
[PE2] ospf
[PE2-ospf] area 0
[PE2-ospf-area-0.0.0.0] network 172.2.2.0 0.0.255.255
[PE2-ospf-area-0.0.0.0] network 202.100.1.2 0.0.0.0
[PE2-ospf-area-0.0.0.0] quit
[PE2-ospf] quit
# 运行IGP路由协议,本例采用OSPF。
[P] ospf
[P-ospf] area 0
[P-ospf-area-0.0.0.0] network 172.1.1.0 0.0.255.255
[P-ospf-area-0.0.0.0] network 172.2.2.0 0.0.255.255
[P-ospf-area-0.0.0.0] quit
[P-ospf] quit
[PE1]display ospf peer
RouterID: 10.110.95.159 Address: 172.1.1.2
State: Full Mode: Nbr is Slave Priority: 1
DR: 172.1.1.1 BDR: 172.1.1.2
Dead timer expires in 38s
Neighbor comes up for 00:02:00
PING 202.100.1.2: 56 data bytes, press CTRL_C to break
Reply from 202.100.1.2: bytes=56 Sequence=1 ttl=254 time = 3 ms
Reply from 202.100.1.2: bytes=56 Sequence=2 ttl=254 time = 3 ms
Reply from 202.100.1.2: bytes=56 Sequence=3 ttl=254 time = 4 ms
Reply from 202.100.1.2: bytes=56 Sequence=4 ttl=254 time = 3 ms
Reply from 202.100.1.2: bytes=56 Sequence=5 ttl=254 time = 3 ms
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 3/3/4 ms
[P]display ospf peer
RouterID: 10.110.95.169 Address: 172.1.1.1
State: Full Mode: Nbr is Master Priority: 1
DR: 172.1.1.1 BDR: 172.1.1.2
Dead timer expires in 40s
Neighbor comes up for 00:05:00
RouterID: 10.110.95.158 Address: 172.2.2.2
State: Full Mode: Nbr is Slave Priority: 1
DR: 172.2.2.2 BDR: 172.2.2.1
Dead timer expires in 37s
Neighbor comes up for 00:04:17
配置要点:M-BGP的配置包括PE之间的IBGP邻居以及PE和CE之间的EBGP邻居。PE之间的IBGP邻居需要用32位掩码的Loopback接口来建立和连接。
# 配置BGP,PE1所在区域号为100
[PE1] bgp 100
# PE与CE之间运行EBGP协议。
[PE1-bgp] ipv4-family vpn-instance vpna
[PE1-bgp-af-vpn-instance] peer 168.1.1.2 as-number 65410
[PE1-bgp-af-vpn-instance] import-route direct
[PE1-bgp-af-vpn-instance] quit
[PE1-bgp] ipv4-family vpn-instance vpnb
[PE1-bgp-af-vpn-instance] peer 168.2.2.2 as-number 65420
[PE1-bgp-af-vpn-instance] import-route direct
[PE1-bgp-af-vpn-instance] quit
# 配置PE的PE对等体、AS号及BGP连接所使用的接口(一般用Loopback接口)。
[PE1-bgp] peer 202.100.1.2 as-number 100
[PE1-bgp] peer 202.100.1.2 connect-interface loopback0
# 激活PE对等体。
[PE1-bgp] ipv4-family vpnv4
[PE1-bgp-af-vpn] peer 202.100.1.2 enable
[PE1-bgp-af-vpn] quit
[PE1-bgp] quit
# 配置BGP,PE2所在区域号为100
[PE2] bgp 100
# PE与CE之间运行EBGP协议。
[PE2-bgp] ipv4-family vpn-instance vpna
[PE2-bgp-af-vpn-instance] peer 168.3.3.2 as-number 65430
[PE2-bgp-af-vpn-instance] import-route direct
[PE2-bgp-af-vpn-instance] quit
[PE2-bgp] ipv4-family vpn-instance vpnb
[PE2-bgp-af-vpn-instance] peer 168.4.4.2 as-number 65440
[PE2-bgp-af-vpn-instance] import-route direct
[PE2-bgp-af-vpn-instance] quit
# 配置PE的PE对等体、AS号及BGP连接所使用的接口(一般用Loopback接口)。
[PE2-bgp] peer 202.100.1.1 as-number 100
[PE2-bgp] peer 202.100.1.1 connect-interface loopback0
# 激活PE对等体。
[PE2-bgp] ipv4-family vpnv4
[PE2-bgp-af-vpn] peer 202.100.1.1 enable
[PE2-bgp-af-vpn] quit
[PE2-bgp] quit
# 配置路由协议。
[CE1] bgp 65410
[CE1-bgp] peer 168.1.1.1 as-number 100
[CE1-bgp]import-route direct
[CE1-bgp] quit
# 配置路由协议。
[CE2] bgp 65420
[CE2-bgp] peer 168.2.2.1 as-number 100
[CE2-bgp]import-route direct
[CE2-bgp] quit
# 配置路由协议。
[CE3] bgp 65430
[CE3-bgp] peer 168.3.3.1 as-number 100
[CE3-bgp]import-route direct
[CE3-bgp] quit
# 配置路由协议。
[CE4] bgp 65440
[CE4-bgp] peer 168.4.4.1 as-number 100
[CE4-bgp]import-route direct
[CE4-bgp] quit
[PE1]disp bgp vpnv4 all peer
--------------------------------------------------------------------------------
168.1.1.2 65410 4 0 3 4 00:01:32 Established
168.2.2.2 65420 4 0 0 0 00:01:52 Established
202.100.1.2 100 4 0 0 0 00:02:32 Established
[PE2]display bgp vpnv4 all peer
--------------------------------------------------------------------------------
168.3.3.2 65430 4 2 3 0 00:04:44 Established
168.4.4.2 65440 4 0 0 0 00:05:35 Established
202.100.1.1 100 4 0 0 0 00:03:21 Established
[CE1]ping 168.3.3.2
PING 168.3.3.2: 56 data bytes, press CTRL_C to break
Reply from 168.3.3.2: bytes=56 Sequence=1 ttl=252 time = 4 ms
Reply from 168.3.3.2: bytes=56 Sequence=2 ttl=252 time = 3 ms
Reply from 168.3.3.2: bytes=56 Sequence=3 ttl=252 time = 3 ms
Reply from 168.3.3.2: bytes=56 Sequence=4 ttl=252 time = 3 ms
Reply from 168.3.3.2: bytes=56 Sequence=5 ttl=252 time = 3 ms
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 3/3/4 ms
[CE2]ping 168.4.4.2
PING 168.4.4.2: 56 data bytes, press CTRL_C to break
Reply from 168.4.4.2: bytes=56 Sequence=1 ttl=252 time = 4 ms
Reply from 168.4.4.2: bytes=56 Sequence=2 ttl=252 time = 3 ms
Reply from 168.4.4.2: bytes=56 Sequence=3 ttl=252 time = 3 ms
Reply from 168.4.4.2: bytes=56 Sequence=4 ttl=252 time = 3 ms
Reply from 168.4.4.2: bytes=56 Sequence=5 ttl=252 time = 3 ms
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 3/3/4 ms
[CE3]ping 168.1.1.2
PING 168.1.1.2: 56 data bytes, press CTRL_C to break
Reply from 168.1.1.2: bytes=56 Sequence=1 ttl=252 time = 3 ms
Reply from 168.1.1.2: bytes=56 Sequence=2 ttl=252 time = 3 ms
Reply from 168.1.1.2: bytes=56 Sequence=3 ttl=252 time = 3 ms
Reply from 168.1.1.2: bytes=56 Sequence=4 ttl=252 time = 3 ms
Reply from 168.1.1.2: bytes=56 Sequence=5 ttl=252 time = 4 ms
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 3/3/4 ms
CE4显示结果:
[CE4]ping 168.2.2.2
PING 168.2.2.2: 56 data bytes, press CTRL_C to break
Reply from 168.2.2.2: bytes=56 Sequence=1 ttl=252 time = 3 ms
Reply from 168.2.2.2: bytes=56 Sequence=2 ttl=252 time = 3 ms
Reply from 168.2.2.2: bytes=56 Sequence=3 ttl=252 time = 3 ms
Reply from 168.2.2.2: bytes=56 Sequence=4 ttl=252 time = 3 ms
Reply from 168.2.2.2: bytes=56 Sequence=5 ttl=252 time = 4 ms
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 3/3/4 ms
PE1配置:
#
sysname PE1
#
mpls lsr-id 172.1.1.1
#
mpls ldp
#
ip vpn-instance vpna
route-distinguisher 100:1
vpn-target 100:1 export-extcommunity
vpn-target 100:1 import-extcommunity
vpn-target 100:3 import-extcommunity
#
ip vpn-instance vpnb
route-distinguisher 100:2
vpn-target 100:2 export-extcommunity
vpn-target 100:2 import-extcommunity
vpn-target 100:4 import-extcommunity
#
interface Ethernet1/0/0
negotiation auto
undo shutdown
ip binding vpn-instance vpna
ip address 168.1.1.1 255.255.0.0
#
interface Ethernet1/0/1
negotiation auto
undo shutdown
ip binding vpn-instance vpnb
ip address 168.2.2.1 255.255.0.0
#
interface Pos2/0/0
undo shutdown
ip address 172.1.1.1 255.255.0.0
mpls ldp enable
#
interface LoopBack0
ip address 202.100.1.1 255.255.255.255
#
bgp 100
undo synchronization
peer 202.100.1.2 as-number 100
peer 202.100.1.2 connect-interface LoopBack0
#
ipv4-family vpn-instance vpna
import-route direct
undo synchronization
peer 168.1.1.2 as-number 64510
#
ipv4-family vpn-instance vpnb
import-route direct
undo synchronization
peer 168.2.2.2 as-number 64520
#
ipv4-family vpnv4
peer 202.100.1.2 enable
#
ospf
#
area 0.0.0.0
network 172.1.0.0 0.0.255.255
network 202.100.1.1 0.0.0.0
#
#
sysname PE2
#
mpls lsr-id 172.2.2.2
#
mpls ldp
#
ip vpn-instance vpna
route-distinguisher 100:3
vpn-target 100:3 export-extcommunity
vpn-target 100:1 import-extcommunity
vpn-target 100:3 import-extcommunity
#
ip vpn-instance vpnb
route-distinguisher 100:4
vpn-target 100:4 export-extcommunity
vpn-target 100:2 import-extcommunity
vpn-target 100:4 import-extcommunity