MPLS VPN VRF Export Map

When you use the route-target export command for a VRF, it adds the same route-target to all VPN routes. With an export map, you can use the power of a route-map to decide which VPN routes should get exported and what route-targets to use.

Let’s look at an example. Consider the following topology:

Mpls Vpn Pe Ce Two Loopbacks

We have a simple MPLS VPN PE CE topology with a single customer that has two sites. Each site has a router with two loopback interfaces. Take a look at the VRF configuration of PE1 and PE2:

PE1#show running-config | begin ip vrf  
ip vrf CUSTOMER
 rd 1:1
 route-target export 1:1
 route-target import 2:2
PE2#show running-config | begin ip vrf 
ip vrf CUSTOMER
 rd 1:1
 route-target export 2:2
 route-target import 1:1

VPN routes on PE1 are exported with RT 1:1 and PE2 exports its VPN routes with RT 2:2.

With the route-target export command, all VPN routes are exported. There is no way to filter anything. This means that CE1 and CE2 will learn about each other’s routes that they advertise:

CE1#show ip route ospf

      5.0.0.0/32 is subnetted, 1 subnets
O IA     5.5.5.5 [110/3] via 192.168.12.2, 00:09:03, GigabitEthernet0/1
      55.0.0.0/32 is subnetted, 1 subnets
O IA     55.55.55.55 [110/3] via 192.168.12.2, 00:00:02, GigabitEthernet0/1
O IA  192.168.45.0/24 [110/2] via 192.168.12.2, 00:09:03, GigabitEthernet0/1
CE2#show ip route ospf

      1.0.0.0/32 is subnetted, 1 subnets
O IA     1.1.1.1 [110/3] via 192.168.45.4, 00:09:31, GigabitEthernet0/1
      11.0.0.0/32 is subnetted, 1 subnets
O IA     11.11.11.11 [110/3] via 192.168.45.4, 00:00:45, GigabitEthernet0/1
O IA  192.168.12.0/24 [110/2] via 192.168.45.4, 00:09:31, GigabitEthernet0/1

We can see the RT that was added. For example, here’s PE1:

PE1#show ip bgp vpnv4 all 1.1.1.1/32 | include Extended
      Extended Community: RT:1:1 OSPF DOMAIN ID:0x0005:0x000000020200
PE1#show ip bgp vpnv4 all 11.11.11.11/32 | include Extended
      Extended Community: RT:1:1 OSPF DOMAIN ID:0x0005:0x000000020200
PE1#show ip bgp vpnv4 all 192.168.12.0/24 | include Extended
      Extended Community: RT:1:1 OSPF DOMAIN ID:0x0005:0x000000020200

What if I want to filter some of these VPN routes? Or use a different route-target for some of them? That’s what we have export maps for…

Configuration

I will use the topology from above to demonstrate the export map. If you want to follow along, you can use my configurations:

  • Configurations
  • CE1
  • CE2
  • P
  • PE1
  • PE2

Want to take a look for yourself? Here you will find the startup configuration of each device.

Empty Export Map

Let’s start with a simple example. I will create a new route-map that permits everything and sets the route-target to 3:3:

PE1(config)#route-map EXPORT_MAP permit 10
PE1(config-route-map)#set extcommunity rt 3:3

You activate it under the VRF configuration with the export map command:

PE1(config)#ip vrf CUSTOMER
PE1(config-vrf)#export map EXPORT_MAP

Let’s look at the result:

PE1#show ip bgp vpnv4 all 1.1.1.1/32 | include Extended    
      Extended Community: RT:3:3 OSPF DOMAIN ID:0x0005:0x000000020200
PE1#show ip bgp vpnv4 all 11.11.11.11/32 | include Extended
      Extended Community: RT:3:3 OSPF DOMAIN ID:0x0005:0x000000020200
PE1#show ip bgp vpnv4 all 192.168.12.0/24 | include Extended
      Extended Community: RT:3:3 OSPF DOMAIN ID:0x0005:0x000000020200

As you can see above, it overwrites the RT that is set with the route-target export command. All routes now have an RT of 3:3.

Export Map with Prefix-list

The output we just saw might not be what we are looking for. Let’s try something else. What if we only want to set the RT to 3:3 for the 1.1.1.1/32 prefix from CE1?

We can do this with an access-list or prefix-list. I’ll use a prefix-list:

PE1(config)#ip prefix-list CE1_L0 permit 1.1.1.1/32
PE1(config)#route-map EXPORT_MAP permit 10
PE1(config-route-map)#match ip address prefix-list CE1_L0

Here’s what the VPN routes now look like on PE1:

PE1#show ip bgp vpnv4 all 1.1.1.1/32 | include Extended
      Extended Community: RT:3:3 OSPF DOMAIN ID:0x0005:0x000000020200
PE1#show ip bgp vpnv4 all 11.11.11.11/32 | include Extended
      Extended Community: RT:1:1 OSPF DOMAIN ID:0x0005:0x000000020200
PE1#show ip bgp vpnv4 all 192.168.12.0/24 | include Extended
      Extended Community: RT:1:1 OSPF DOMAIN ID:0x0005:0x000000020200

This is looking better. 1.1.1.1/32 has the RT of 3:3 and all other VPN routes still have RT 1:1 that was set with the route-target export command.

Because of the new RT, CE2 no longer has 1.1.1.1/32:

CE2#show ip route 1.1.1.1 
% Network not in table

If we want CE2 to have this route, we’ll have to import the new RT on PE2:

PE2(config)#ip vrf CUSTOMER
PE2(config-vrf)#route-target import 3:3

Now it’s back:

CE2#show ip route 1.1.1.1
Routing entry for 1.1.1.1/32
  Known via "ospf 1", distance 110, metric 3, type inter area
  Last update from 192.168.45.4 on GigabitEthernet0/1, 00:00:21 ago
  Routing Descriptor Blocks:
  * 192.168.45.4, from 192.168.45.4, 00:00:21 ago, via GigabitEthernet0/1
      Route metric is 3, traffic share count is 1

Export Map Additive

In the previous two examples, the export map has overwritten our RT. It’s also possible to add an additional RT. You only have to add the additive parameter in your route-map: