Subject: Re: Unusual Hub-Spoke Configuration

From: jim guichard <[email-masked]>
Date: Fri, 18 May 2001 10:09:05 +0100

Mike,

this type of topology allows all spoke to spoke communication to flow via a 
hub site - this is just manipulation of the route-target. A simple example 
of its usage is the need to deploy a firewall between spoke sites. Jim

At 09:57 18/05/2001 +0100, Gould, Michael wrote:
>In the JunOS MPLS Applications Guide 4.4, the example of a Hub-and-Spoke
>MPLS VPN configuration is very unusual.
>
>It states that: "For a hub-and-Spoke VPN topology to function properly,
>there must be two interfaces connecting the hub PE router to the hub CE
>router, and each interface must have its own VRF table on the PE router."
>
>It then goes on to describe a configuration where there are 2 VRF tables for
>a single hub site.  One table imports only routes from the spoke sites and
>exports nothing.  The other table exports routes from the hub site and
>imports nothing.  The example is definitely not refering to a management VPN
>and there is only one hub CE.
>
>Although it looks like this configuration would work, we have never needed
>more than one interface or VRF table per hub site.  Does anyone know the
>reason for this particular configuration?
>
>
>Mike Gould
>orchestream.com
>
>
>
>--
>This communication contains confidential information intended solely for 
>the use of the individual/s and/or entity or entities to whom it was 
>intended to be addressed.  If you are not the intended recipient, be aware 
>that any disclosure, copying, distribution, or use of the contents of this 
>transmission is prohibited.  If you have received this communication in 
>error, please contact the sender immediately, delete this communication 
>from your system, and do not disclose its contents to any third party, or 
>use its contents.  Any opinions expressed are solely those of the author 
>and do not necessarily represent those of Orchestream Ltd or its group of 
>companies unless otherwise specifically stated.

Jim Guichard CCIE #2069
Technical Leader EMEA

+44 208 756 8806
Mobile: +44 7802 809763

---

From: "Alexander Marhold" <[email-masked]>
Date: Fri, 18 May 2001 12:03:31 +0200

Mike

Unfortunately "HUB and spoke" can be interpreted differently.

If the network need to emulate FR-behaviour you need 2 interfaces in 2
separate VRFs as Jim has mentioned.

If you only need get packets running between spoke sites to the HUB-CE in
order to do accounting, ---> then this also works with only one single
interface and a single vrf and a clever usage of the default route !

From the SPOKEs to the hub you send the specific routes,
the CE on the hub site announces only the default route towards the MPLS/VPN
cloud
the Spoke-PEs in that way only receive the default route imported from the
HUB-vrf

then the Spoke PE sends all packets for other destinations on an LSP ( bound
to the default route) to the HUB-CE, which does a L3 lookup, finds the
destination address and sends the packet back to the hub-PE.
This one, using an LSP for the specific address forwards the packet to the
destination Spoke-CE.

In that way all packets between Spoke sites will enter the HUB-CE and can be
accounted.

(This is a tested configuration, usage can be for Bandwidth brokerage over
an MPLS/VPN network)

with best regards

Alexander

__/__/__/__/__/__/__/__/__/__/__/__/__/__/__/__/__/__/__/__/__/
     __/
    __/   Dipl.Ing. Alexander Marhold MBA
   __/   CCIE #3324, CCNP, CCNA, CCDP, CCDA, CCSI #20642
  __/   PRO IN <Senior Consultant, PM and Trainer>
 __/   Mobile: ++43-(0)664-16 28 234
__/

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of jim
guichard
Sent: Friday, May 18, 2001 11:09 AM
To: Gould, Michael
Cc: [email-masked]
Subject: Re: Unusual Hub-Spoke Configuration

Mike,

Jim Guichard CCIE #2069
Technical Leader EMEA

+44 208 756 8806
Mobile: +44 7802 809763