Shafagh.com Shafagh Zandi Official Blog

The carrier supporting carrier feature enables one MPLS VPN-based service provider to allow other service providers (Tier2) to use its backbone network for connectivity of their POPs.  It is also called a carrier-of-carriers VPN. It is a two-tiered relationship between a provider carrier and a customer carrier. In a carrier-of-carriers VPN, the provider carrier provides a VPN backbone network for the customer carrier. The customer carrier, in turn, provides layer 3 VPN or Internet services to its end customers.

You may say that: “so what’s the difference between MPLS VPN and CSC? in MPLS VPN we do the same thing for customers!” well, It is true with one exception, in CSC, the provider carrier does not like to have all routing information for it’s customer carriers, the provider only delivers customers tag regardless of the final destination. In this case customer (Tier 2 ISP) sends labeled traffic to carrier (Tier 1 ISP) just to deliver it to the next-hop on the other side of the network.

Example 1:

In our example, R1 and R2 are CSC_PE while R3 and R4 are CSC_CE, acting like CE routers for the provider carrier’s PE routers and the only difference  is that customer carrier speaks in label language. So whenever we run a label protocol on a VRF port – then it is CSC.

Note: To the customer carrier, the router it uses to connect to the provider carrier’s VPN is a PE router. However, the provider carrier views this device as a CE router (http://www.juniper.net/techpubs/software/erx/junose53/swconfig-routing-vol2/html/bgp-mpls-vpns-config12.html)

Configuration

R1:
ip vrf A
rd 10.10.1.1:1
route-target export 666:1
route-target import 666:1
!
interface Loopback0
ip address 10.10.1.1 255.255.255.255
ip router isis
!
interface FastEthernet0/0
ip address 10.10.12.1 255.255.255.0
ip router isis
mpls label protocol ldp
mpls ip
!
interface ATM2/0
 ip vrf forwarding A
ip address 10.10.13.1 255.255.255.0
ip ospf network point-to-point
 mpls ip
pvc 100/0
  protocol ip 10.10.13.3 broadcast
!
!
router ospf 10 vrf A
redistribute bgp 666 subnets
network 10.10.13.1 0.0.0.0 area 0
 area 0 sham-link 10.10.134.1 10.10.134.2
!
router isis
net 69.0000.0000.0001.00
is-type level-2-only
!
router bgp 666
no bgp default ipv4-unicast
bgp log-neighbor-changes
neighbor 10.10.2.2 remote-as 666
neighbor 10.10.2.2 update-source Loopback0
!
address-family vpnv4
neighbor 10.10.2.2 activate
neighbor 10.10.2.2 send-community extended
exit-address-family
!
address-family ipv4 vrf A
redistribute ospf 10 vrf A
no auto-summary
no synchronization
exit-address-family
!

R2:
ip vrf A 
rd 10.10.2.2:1
route-target export 666:1
route-target import 666:1
!
interface Loopback0
ip address 10.10.2.2 255.255.255.255
ip router isis
!
interface Ethernet0/0
ip address 10.10.12.2 255.255.255.0
ip router isis
mpls label protocol ldp
mpls ip
!
interface Serial1/0
 ip vrf forwarding A
ip address 10.10.24.2 255.255.255.0
encapsulation frame-relay
ip ospf network point-to-point
 mpls ip
frame-relay map ip 10.10.24.2 204
frame-relay map ip 10.10.24.4 204 broadcast
no frame-relay inverse-arp
!
router ospf 10 vrf A
redistribute bgp 666 subnets
network 10.10.24.2 0.0.0.0 area 0
area 0 sham-link 10.10.134.2 10.10.134.1
!
router isis
net 69.0000.0000.0002.00
is-type level-2-only
!
router bgp 666
no bgp default ipv4-unicast
bgp log-neighbor-changes
neighbor 10.10.1.1 remote-as 666
neighbor 10.10.1.1 update-source Loopback0
!
address-family ipv4
  neighbor 10.10.1.1 activate
  no auto-summary
  no synchronization
exit-address-family
!
address-family vpnv4
  neighbor 10.10.1.1 activate
  neighbor 10.10.1.1 send-community extended
exit-address-family
!
address-family ipv4 vrf A
  redistribute ospf 10 vrf A
  no synchronization
exit-address-family
!

R3:      
interface ATM2/0
ip address 10.10.13.3 255.255.255.0
ip ospf network point-to-point
mpls ip
pvc 100/0
  protocol ip 10.10.13.1 broadcast
!
!
router ospf 10
network 10.10.3.3 0.0.0.0 area 0
network 10.10.13.3 0.0.0.0 area 0
network 10.10.35.3 0.0.0.0 area 0
!
router bgp 3456
no synchronization
neighbor 10.10.4.4 remote-as 3456
neighbor 10.10.4.4 update-source Loopback0
neighbor 10.10.35.5 remote-as 3456
neighbor 10.10.35.5 route-reflector-client
no auto-summary
!

R4:
interface Serial1/0
ip address 10.10.24.4 255.255.255.0
encapsulation frame-relay
ip ospf network point-to-point
mpls ip
frame-relay map ip 10.10.24.2 402 broadcast
frame-relay map ip 10.10.24.4 402
no frame-relay inverse-arp
!
router ospf 10
network 10.10.4.4 0.0.0.0 area 0
network 10.10.24.4 0.0.0.0 area 0
network 10.10.46.4 0.0.0.0 area 0
!
router bgp 3456
no synchronization
bgp log-neighbor-changes
neighbor 10.10.3.3 remote-as 3456
neighbor 10.10.3.3 update-source Loopback0
neighbor 10.10.46.6 remote-as 3456
neighbor 10.10.46.6 route-reflector-client
no auto-summary
!

R5:
router ospf 10
network 10.10.35.5 0.0.0.0 area 0
!
router rip
version 2
redistribute bgp 3456 metric transparent
passive-interface default
no passive-interface Ethernet0/2
no passive-interface Ethernet0/3
network 10.0.0.0
no auto-summary
!
router bgp 3456
no synchronization
bgp log-neighbor-changes
 bgp redistribute-internal
network 10.10.7.7 mask 255.255.255.255
network 10.10.9.9 mask 255.255.255.255
neighbor 10.10.35.3 remote-as 3456
neighbor 10.10.35.3 next-hop-self
no auto-summary
!

R6:
router ospf 10
network 10.10.46.6 0.0.0.0 area 0
!
router rip
version 2
redistribute bgp 3456 metric transparent
passive-interface default
no passive-interface Ethernet0/2
no passive-interface Ethernet0/3
network 10.0.0.0
no auto-summary
!
router bgp 3456
no synchronization
bgp log-neighbor-changes
 bgp redistribute-internal
network 10.10.8.8 mask 255.255.255.255
network 10.10.10.10 mask 255.255.255.255
neighbor 10.10.46.4 remote-as 3456
neighbor 10.10.46.4 next-hop-self
no auto-summary
!

CE:
R7#trace 10.10.8.8 source 10.10.7.7

  1 10.10.57.5
  2 10.10.35.3
  3 10.10.13.1 [MPLS: Label 22 Exp 0]
  4 10.10.24.2 [MPLS: Label 21 Exp 0]
  5 10.10.24.4
  6 10.10.46.6
  7 10.10.68.8

R8#trace 10.10.7.7 source 10.10.8.8

  1 10.10.68.6
  2 10.10.46.4
  3 10.10.12.2 [MPLS: Label 20 Exp 0]
  4  *  *  *
  5 10.10.13.3
  6 10.10.35.5
  7 10.10.57.7

What if the customer carrier wants to run MPLS VPN, it’s same as previous example with minor adjustments.

Example 2:

In our second example, MP-iBGP is used between customer carrier and OSPF as IGP. LSP is end to end from PE to PE.

R1:

ip vrf A
rd 10.10.1.1:1
route-target export 666:1
route-target import 666:1
!
interface Loopback0
ip address 10.10.1.1 255.255.255.255
ip router isis
!
interface Loopback2
ip vrf forwarding A
ip address 10.10.134.1 255.255.255.255
!        
interface FastEthernet0/0
ip address 10.10.12.1 255.255.255.0
ip router isis
mpls label protocol ldp
mpls ip
!
interface ATM2/0
ip vrf forwarding A
ip address 10.10.13.1 255.255.255.0
ip ospf network point-to-point
mpls ip
pvc 100/0
  protocol ip 10.10.13.3 broadcast
!
!
router ospf 10 vrf A
log-adjacency-changes
area 0 sham-link 10.10.134.1 10.10.134.2
redistribute bgp 666 subnets
network 10.10.13.1 0.0.0.0 area 0
!
router isis
net 69.0000.0000.0001.00
is-type level-2-only
!
router bgp 666
no bgp default ipv4-unicast
neighbor 10.10.2.2 remote-as 666
neighbor 10.10.2.2 update-source Loopback0
!
address-family vpnv4
neighbor 10.10.2.2 activate
neighbor 10.10.2.2 send-community extended
exit-address-family
!
address-family ipv4 vrf A
redistribute ospf 10 vrf A
no auto-summary
no synchronization
network 10.10.134.1 mask 255.255.255.255
exit-address-family
!

R3:

interface ATM2/0
ip address 10.10.13.3 255.255.255.0
ip ospf network point-to-point
mpls ip
pvc 100/0
  protocol ip 10.10.13.1 broadcast
!
!
router ospf 10
network 10.10.3.3 0.0.0.0 area 0
network 10.10.13.3 0.0.0.0 area 0
network 10.10.35.3 0.0.0.0 area 0
!

R5:

ip vrf A 
rd 10.10.5.5:1
route-target export 56:1
route-target import 56:1
!
ip vrf B
rd 10.10.5.5:2
route-target export 56:2
route-target import 56:2
!
router ospf 10
network 10.10.5.5 0.0.0.0 area 0
network 10.10.35.5 0.0.0.0 area 0
!
router rip
version 2
no auto-summary
!
address-family ipv4 vrf B
  redistribute bgp 56 metric transparent
  network 10.0.0.0
  no auto-summary
exit-address-family
!       
address-family ipv4 vrf A
  redistribute bgp 56 metric transparent
  network 10.0.0.0
  no auto-summary
exit-address-family
!
router bgp 56
no bgp default ipv4-unicast
bgp log-neighbor-changes
neighbor 10.10.6.6 remote-as 56
neighbor 10.10.6.6 update-source Loopback0
!
address-family vpnv4
  neighbor 10.10.6.6 activate
  neighbor 10.10.6.6 send-community extended
exit-address-family
!       
address-family ipv4 vrf B
  redistribute rip
  no synchronization
exit-address-family
!
address-family ipv4 vrf A
  redistribute rip
  no synchronization
exit-address-family
!

CE:
R7#traceroute 10.10.8.8 source 10.10.7.7

  1 10.10.57.5 
  2 10.10.35.3 [MPLS: Labels 19/22 Exp 0] 
  3 10.10.13.1 [MPLS: Labels 23/22 Exp 0] 
  4 10.10.24.2 [MPLS: Labels 23/22 Exp 0] 
  5 10.10.24.4 [MPLS: Labels 19/22 Exp 0] 
  6 10.10.68.6 [MPLS: Label 22 Exp 0] 
  7 10.10.68.8

In this case as we have only two routers at provider’s core, we do not see a third label in the label stack.

The third option for Inter-AS MPLS VPN is using multihop feature of eBGP between VPNv4 PE routers directly from one SP to another one. In the previous posts, we reviewed two other options:

Back to back VRF Inter-AS MPLS VPN

External MP-BGP for VPNv4

In the multihop MP-eBGP, LSP is built end-to-end by PE routers between providers. ASBRs only provide routing between PE routers within two autonomous systems. With having PE routing information, VPNv4 BGP can be built directly from one VRF to another VRF by eBGP multihop between MP-BGP neighbors at different autonomous systems. So that VPN PE routers do not need to run BGP with anyone else and routing information is not exchanged with ASBRs. Let’s go back to our example:

Now we extend the VPN with end-to-end LSP from AS700 VPN-PE (R3) to other PE (R2) at AS 600:

• ASBRs (R6 & R7) exchange routes for R2 and R3 reachability.
• R6 advertises prefix 2.2.2.2/32 and R7 advertises 3.3.3.3/32 (both ASBR advertise internal MP-eBGP PE routers)
• R6 and R7 redistribute the received BGP route of other PE to their IGP for creating multihop reachability.
• R6 and R7, exchange labels by “neighbor x.x.x.x send-label” command to join the end to end LSP.

PE Configuration

R3:

ip vrf A 
rd 3.3.3.3:1
route-target export 700:1
route-target import 600:1
!
router ospf 1
mpls ldp autoconfig area 0
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0
!
router rip
version 2
no auto-summary
!
address-family ipv4 vrf A
  redistribute bgp 700 metric transparent
  network 172.16.0.0
  no auto-summary
exit-address-family
!
router bgp 700
no bgp default ipv4-unicast
bgp log-neighbor-changes
neighbor 2.2.2.2 remote-as 600
 neighbor 2.2.2.2 ebgp-multihop 6
neighbor 2.2.2.2 update-source Loopback0
!       
address-family vpnv4
  neighbor 2.2.2.2 activate
  neighbor 2.2.2.2 send-community extended
exit-address-family
!
address-family ipv4 vrf A
  redistribute rip
  no synchronization
exit-address-family
!

R3#sh ip bgp vpn all
BGP table version is 24, local router ID is 3.3.3.3

   Network          Next Hop        Metric  Weight Path
Route Distinguisher: 2.2.2.2:1
*> 150.1.4.4/32     2.2.2.2              1       0 600 ?
*> 172.16.24.0/24   2.2.2.2              0       0 600 ?
*> 172.16.45.0/24   2.2.2.2              1       0 600 ?
Route Distinguisher: 3.3.3.3:1 (default for vrf A)
*> 150.1.4.4/32     2.2.2.2              1       0 600 ?
*> 150.1.5.5/32     172.16.35.5          1       32768 ?
*> 172.16.24.0/24   2.2.2.2              0       0 600 ?
*> 172.16.35.0/24   0.0.0.0              0       32768 ?
*  172.16.45.0/24   2.2.2.2              1       0 600 ?
*>                  172.16.35.5          1       32768 ?

R3#sh ip bgp vpn all label
   Network          Next Hop      In label/Out label
Route Distinguisher: 2.2.2.2:1
   150.1.4.4/32     2.2.2.2         nolabel/16
   172.16.24.0/24   2.2.2.2         nolabel/20
   172.16.45.0/24   2.2.2.2         nolabel/21
Route Distinguisher: 3.3.3.3:1 (A)
   150.1.4.4/32     2.2.2.2         nolabel/16
   150.1.5.5/32     172.16.35.5     24/nolabel
   172.16.24.0/24   2.2.2.2         nolabel/20
   172.16.35.0/24   0.0.0.0         23/aggregate(A)
   172.16.45.0/24   2.2.2.2         22/21
                    172.16.35.5     22/nolabel

R3#sh mpls forwarding-table
Local  Outgoing    Prefix             Outgoing  Next Hop   
tag    tag or VC   or Tunnel Id       interface             
16     17          2.2.2.2/32         Et0/0     172.16.30.10
17     Pop tag     172.16.70.0/24     Et0/0     172.16.30.10
18     16          7.7.7.7/32         Et0/0     172.16.30.10
20     Pop tag     10.10.10.10/32     Et0/0     172.16.30.10
22     Untagged    172.16.45.0/24[V]  Et0/1     172.16.35.5 
23     Aggregate   172.16.35.0/24[V]                               
24     Untagged    150.1.5.5/32[V]    Et0/1     172.16.35.5

R0:

R0#sh mpls forwarding-table
Local  Outgoing    Prefix            Outgoing   Next Hop   
tag    tag or VC   or Tunnel Id      interface             
16     Pop tag     7.7.7.7/32        Et0/0      172.16.70.7 
17     20          2.2.2.2/32        Et0/0      172.16.70.7 
19     Pop tag     3.3.3.3/32        Et0/1      172.16.30.3 

R7:

router ospf 10
log-adjacency-changes
 redistribute bgp 700 metric-type 1 subnets route-map AS600->MPBGP
network 7.7.7.7 0.0.0.0 area 0
network 172.16.70.0 0.0.0.255 area 0
!
router bgp 700
bgp log-neighbor-changes
neighbor 172.16.67.6 remote-as 600
!
address-family ipv4
  neighbor 172.16.67.6 activate
  neighbor 172.16.67.6 send-label
  no auto-summary
  no synchronization
  network 3.3.3.3 mask 255.255.255.255
exit-address-family     
!        
ip prefix-list AS600->MPBGP seq 5 permit 2.2.2.2/32
!        
route-map AS600->MPBGP permit 10
match ip address prefix-list AS600->MPBGP
!

R7#sh mpls forwarding-table
Local  Outgoing    Prefix            Outgoing   Next Hop   
tag    tag or VC   or Tunnel Id      interface             
16     19          3.3.3.3/32        Et0/0      172.16.70.10
17     Pop tag     172.16.30.0/24    Et0/0      172.16.70.10
18     Pop tag     10.10.10.10/32    Et0/0      172.16.70.10
19     Pop tag     172.16.67.6/32    Et0/1.10   172.16.67.6 
20     18          2.2.2.2/32        Et0/1.10   172.16.67.6 

CE Router:

R5#trace 150.1.4.4 source 150.1.5.5 

  1 172.16.35.3 
  2 172.16.30.10 [MPLS: Labels 17/16 Exp 0] 
  3 172.16.70.7 [MPLS: Labels 20/16 Exp 0] 
  4 172.16.67.6 [MPLS: Labels 18/16 Exp 0] 
  5 172.16.16.1 [MPLS: Labels 18/16 Exp 0] 
  6 172.16.24.2 [MPLS: Label 16 Exp 0] 
  7 172.16.24.4

In the previous post, we reviewed VRF-to-VRF Inter-AS MPLS VPNs, now we want to go over the other option, which is the use of MP-eBGP at ASBRs for prefix exchange. This method is more scalable and felixable than back-to-back VRFs and only one interface is required between providers routers.

• No VRF is required.
• Automatic Route filtering must be disabled (no bgp default route-target filter)
• MPLS Label switching between providers is required (using MP-eBGP)
• Next-hop-self is required on ASBRs for internal PE neighbors.
• Eliminates the need of any other label protocol like LDP/TDP between two ASBRs.
• non-VPN networks can act as transit network for VPN traffic.

With reference to our previous setup, we are going to create MP-iBGP between PEs inside AS and MP-eBGP between ASBRs.

PE Configurations

R3:

ip vrf A 
rd 3.3.3.3:1
route-target export 700:1
route-target import 600:1
!
router ospf 1
mpls ldp autoconfig area 0
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0
!
router rip
version 2
no auto-summary
!
address-family ipv4 vrf A
  redistribute bgp 700 metric transparent
  network 172.16.0.0
  no auto-summary
exit-address-family
!
router bgp 700
no bgp default ipv4-unicast
bgp log-neighbor-changes
neighbor 7.7.7.7 remote-as 700
neighbor 7.7.7.7 update-source Loopback0
!
address-family vpnv4
  neighbor 7.7.7.7 activate
  neighbor 7.7.7.7 send-community extended
exit-address-family
!
address-family ipv4 vrf A
  redistribute rip
  no synchronization
exit-address-family
!

R7:
router bgp 700
no bgp default ipv4-unicast
 no bgp default route-target filter
bgp log-neighbor-changes
neighbor 3.3.3.3 remote-as 700
neighbor 3.3.3.3 update-source Loopback0
neighbor 172.16.67.6 remote-as 600
!
address-family vpnv4
  neighbor 3.3.3.3 activate
  neighbor 3.3.3.3 send-community extended
  neighbor 3.3.3.3 next-hop-self
  neighbor 172.16.67.6 activate
  neighbor 172.16.67.6 send-community extended
exit-address-family
!

R7#sh mpls forwarding-table
Local  Outgoing   Prefix         Bytes tag Outgoing Next Hop   
tag    tag or VC  or Tunnel Id   switched  interface             
16     19         3.3.3.3/32               Et0/0    172.16.70.10
17     Pop tag    172.16.30.0/24           Et0/0    172.16.70.10
18     Pop tag    10.10.10.10/32           Et0/0    172.16.70.10
19     26         2.2.2.2:1:172.16.24.0/24 Et0/1.10 172.16.67.6 
20     25         2.2.2.2:1:150.1.4.4/32   Et0/1.10 172.16.67.6 
21     24         2.2.2.2:1:172.16.45.0/24 Et0/1.10 172.16.67.6 
22     Pop tag    172.16.67.6/32           Et0/1.10 172.16.67.6 
23     24         3.3.3.3:1:150.1.5.5/32   Et0/0    172.16.70.10
24     22         3.3.3.3:1:172.16.45.0/24 Et0/0    172.16.70.10
25     23         3.3.3.3:1:172.16.35.0/24 Et0/0    172.16.70.10

R7#sh ip bgp vpnv4 all labels
   Network          Next Hop      In label/Out label
Route Distinguisher: 2.2.2.2:1
   150.1.4.4/32     172.16.67.6     20/25
   172.16.24.0/24   172.16.67.6     19/26
   172.16.45.0/24   172.16.67.6     21/24
Route Distinguisher: 3.3.3.3:1
   150.1.5.5/32     3.3.3.3         23/24
   172.16.35.0/24   3.3.3.3         25/23
   172.16.45.0/24   3.3.3.3         24/22

CE Trace-route  

R5#sh ip route

     172.16.0.0/24 is subnetted, 3 subnets
C       172.16.45.0 is directly connected, Ethernet0/3
C       172.16.35.0 is directly connected, Ethernet0/0
R       172.16.24.0 [120/1] via 172.16.35.3, 00:00:25, Ethernet0/0
     150.1.0.0/32 is subnetted, 2 subnets
C       150.1.5.5 is directly connected, Loopback0
R       150.1.4.4 [120/1] via 172.16.35.3, 00:00:25, Ethernet0/0

R5#trace 150.1.4.4 source 150.1.5.5

  1 172.16.35.3 
  2 172.16.30.10 [MPLS: Labels 16/20 Exp 0] 
  3 172.16.70.7 [MPLS: Label 20 Exp 0] 
  4 172.16.67.6 [MPLS: Label 25 Exp 0] 
  5 172.16.16.1 [MPLS: Labels 18/16 Exp 0] 
  6 172.16.24.2 [MPLS: Label 16 Exp 0] 
  7 172.16.24.4

When customer’s sites are connected to different MPLS providers, there are several options available for providers to connect customer sites just like regular MLPS VPNs transparent to customers. In our example below, the Customer1 has two sites, each connected to an individual service provider. Service providers have several options to achieve this goal, the simplest one – is the VRF-to-VRF (as stated in RFC 4364) or the back-to-back VRF (as named by Cisco). SP connects to other SP through a VRF just like the way they connect to CE so that they can exchange IPv4 routes on that connection point. Each sub-interface between SP to SP has to be dedicated to a single VRF (single customer VPN). These PE routers between service providers are called ASBR. (R6 and R7 in our example)

In this method IP packets are forwarded between ASBRs and no form of LSP exists between providers. Although this form of connectivity is very basic however this is the widely deployed Inter-AS option used today.

• CE routers (4 & 5) communicate with PE (R2 & R3) using RIP.
• PE routers redistribute RIP routes into MP-iBGP (RT=600:1 & RT=700:1)
• PE routers send routes to ASBR PE routers (R6 & R7) using MPLS Core.
• ASBR routers redistribute MP-iBGP into RIP and send them to VRF.
• ASBR routers recieve routes through RIP and export them as RT:600:1 fo AS700 and RT:700:1 for AS600 and import them on PE and redistribute them back to RIP for CE routers.

PE and ASBR Configuration of AS700

R3:

ip vrf A 
rd 3.3.3.3:1
route-target export 700:1
route-target import 600:1
!
interface Loopback0
ip address 3.3.3.3 255.255.255.255
!
interface Ethernet0/0
ip address 172.16.30.3 255.255.255.0
!
interface Ethernet0/1
ip vrf forwarding A
ip address 172.16.35.3 255.255.255.0
!
router ospf 1
mpls ldp autoconfig area 0
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0
!
router rip
version 2
no auto-summary
!
address-family ipv4 vrf A
  redistribute bgp 700 metric transparent
  network 172.16.0.0
  no auto-summary
exit-address-family
!
router bgp 700
no bgp default ipv4-unicast
bgp log-neighbor-changes
neighbor 7.7.7.7 remote-as 700
neighbor 7.7.7.7 update-source Loopback0
!
address-family vpnv4
  neighbor 7.7.7.7 activate
  neighbor 7.7.7.7 send-community extended
exit-address-family
!
address-family ipv4 vrf A
  redistribute rip
  no synchronization
exit-address-family
!

R7:

ip vrf A 
rd 7.7.7.7:1
route-target export 600:1
route-target import 700:1
!
interface Loopback0
ip address 7.7.7.7 255.255.255.255
!
interface Ethernet0/0
ip address 172.16.70.7 255.255.255.0
mpls ip
!
interface Ethernet0/1.10
encapsulation dot1Q 10
ip vrf forwarding A
ip address 172.16.67.7 255.255.255.0
!
router ospf 10
log-adjacency-changes
network 7.7.7.7 0.0.0.0 area 0
network 172.16.70.0 0.0.0.255 area 0
!
router rip
version 2
no auto-summary
!
address-family ipv4 vrf A
  redistribute bgp 700 metric transparent
  network 172.16.0.0
  no auto-summary
exit-address-family
!
router bgp 700
no bgp default ipv4-unicast
bgp log-neighbor-changes
neighbor 3.3.3.3 remote-as 700
neighbor 3.3.3.3 update-source Loopback0
!
address-family vpnv4
  neighbor 3.3.3.3 activate
  neighbor 3.3.3.3 send-community extended
exit-address-family
!
address-family ipv4 vrf A
  redistribute rip
  no synchronization
exit-address-family
!

PE and ASBR Configration of AS600

R2:

ip vrf A 
rd 2.2.2.2:1
route-target export 600:1
route-target import 700:1
!
interface Loopback0
ip address 2.2.2.2 255.255.255.255
!
interface Ethernet0/0
ip address 172.16.12.2 255.255.255.0
!
interface Ethernet0/2
ip vrf forwarding A
ip address 172.16.24.2 255.255.255.0
!
router ospf 1
mpls ldp autoconfig area 0
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0
!
router rip
version 2
no auto-summary
!
address-family ipv4 vrf A
  redistribute bgp 600 metric transparent
  network 172.16.0.0
  no auto-summary
exit-address-family
!
router bgp 600
no bgp default ipv4-unicast
bgp log-neighbor-changes
neighbor 6.6.6.6 remote-as 600
neighbor 6.6.6.6 update-source Loopback0
!       
address-family vpnv4
  neighbor 6.6.6.6 activate
  neighbor 6.6.6.6 send-community extended
exit-address-family
!
address-family ipv4 vrf A
  redistribute rip
  no synchronization
exit-address-family
!

R6:

ip vrf A 
rd 6.6.6.6:1
route-target export 700:1
route-target import 600:1
!
interface Loopback0
ip address 6.6.6.6 255.255.255.255
!
interface Ethernet0/0
ip address 172.16.16.6 255.255.255.0
mpls ip
!
interface Ethernet0/1.10
encapsulation dot1Q 10
ip vrf forwarding A
ip address 172.16.67.6 255.255.255.0
!
router ospf 10
log-adjacency-changes
network 6.6.6.6 0.0.0.0 area 0
network 172.16.16.0 0.0.0.255 area 0
!

router rip
version 2
no auto-summary
!
address-family ipv4 vrf A
  redistribute bgp 600 metric transparent
  network 172.16.0.0
  no auto-summary
exit-address-family
!        
router bgp 600
no bgp default ipv4-unicast
bgp log-neighbor-changes
neighbor 2.2.2.2 remote-as 600
neighbor 2.2.2.2 update-source Loopback0
!
address-family vpnv4
  neighbor 2.2.2.2 activate
  neighbor 2.2.2.2 send-community extended
exit-address-family
!
address-family ipv4 vrf A
  redistribute rip
  no synchronization
exit-address-family
!

CE Routers

R4#sh ip route

     172.16.0.0/24 is subnetted, 4 subnets
C       172.16.45.0 is directly connected, Ethernet0/3
R       172.16.35.0 [120/2] via 172.16.24.2, 00:00:02, Ethernet0/0
C       172.16.24.0 is directly connected, Ethernet0/0
R       172.16.67.0 [120/1] via 172.16.24.2, 00:00:02, Ethernet0/0
     150.1.0.0/32 is subnetted, 2 subnets
R       150.1.5.5 [120/3] via 172.16.24.2, 00:00:02, Ethernet0/0
C       150.1.4.4 is directly connected, Loopback0

R4#ping 150.1.5.5

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 150.1.5.5, timeout is 2 seconds:
.!!!!

R4#traceroute 150.1.5.5 source 150.1.4.4

Type escape sequence to abort.
Tracing the route to 150.1.5.5

  1 172.16.24.2
  2 172.16.12.1 [MPLS: Labels 16/22 Exp 0] 
  3 172.16.67.6 [MPLS: Label 22 Exp 0] 
  4 172.16.67.7
  5 172.16.70.10 [MPLS: Labels 19/16 Exp 0] 
  6 172.16.35.3 [MPLS: Label 16 Exp 0] 
  7 172.16.35.5

Usually service providers assign a unique AS number to each customer’s site for MPLS BGP routing (between PE and CE)… In our example, the Customer1, our favorite customer has four sites using R4, R5, R6 and R7 from AS64 to 67 to use MPLS backbone as transit network to deliver their applications. Customer1 is peering with AS666 (Provider) at each location:

Customer configuration on R4, R5, R6 and R7 is almost similar to each other:

R4:

router bgp 64
no synchronization
bgp log-neighbor-changes
network 150.1.4.4 mask 255.255.255.255
neighbor 172.16.24.2 remote-as 666
no auto-summary

Configuration of PE

R2:

ip vrf CUSTOMER1
rd 2.2.2.2:1
route-target export 666:1
route-target import 666:1
!
router bgp 666
no synchronization
bgp log-neighbor-changes
neighbor 3.3.3.3 remote-as 666
neighbor 3.3.3.3 update-source Loopback0
no auto-summary
!
address-family vpnv4
  neighbor 3.3.3.3 activate
  neighbor 3.3.3.3 send-community extended
exit-address-family
!
address-family ipv4 vrf CUSTOMER1
  neighbor 172.16.24.4 remote-as 64
  neighbor 172.16.24.4 activate
  neighbor 172.16.26.6 remote-as 66
  neighbor 172.16.26.6 activate
  no synchronization
exit-address-family
!

R3:

ip vrf CUSTOMER1
rd 3.3.3.3:1
route-target export 666:1
route-target import 666:1
!
router bgp 666
no synchronization
bgp log-neighbor-changes
neighbor 2.2.2.2 remote-as 666
neighbor 2.2.2.2 update-source Loopback0
no auto-summary
!
address-family vpnv4
  neighbor 2.2.2.2 activate
  neighbor 2.2.2.2 send-community extended
exit-address-family
!
address-family ipv4 vrf CUSTOMER1
  neighbor 172.16.35.5 remote-as 65
  neighbor 172.16.35.5 activate
  neighbor 172.16.37.7 remote-as 67
  neighbor 172.16.37.7 activate
  no synchronization
  network 30.30.30.30 mask 255.255.255.255
exit-address-family
!

R3#sh ip bgp vpnv4 vrf CUSTOMER1 summary
BGP router identifier 3.3.3.3, local AS number 666
BGP table version is 7, main routing table version 7
4 network entries using 548 bytes of memory
4 path entries using 272 bytes of memory
7/4 BGP path/bestpath attribute entries using 868 bytes of memory
4 BGP AS-PATH entries using 96 bytes of memory
1 BGP extended community entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 1808 total bytes of memory
BGP activity 59/55 prefixes, 225/221 paths, scan interval 15 secs

Neighbor     V  AS Rcvd Sent TblVer InQ OutQ Up/Down  State/PfxRcd
172.16.35.5  4  65   98  101      7   0    0 01:33:48       1
172.16.37.7  4  67   99  102      7   0    0 01:34:07       1

R3#sh ip bgp vpnv4 all
BGP table version is 7, local router ID is 3.3.3.3

   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 2.2.2.2:1 (default for vrf CUSTOMER1)
*>i150.1.4.4/32     2.2.2.2                  0    100      0 64 i
*> 150.1.5.5/32     172.16.35.5              0             0 65 i
*>i150.1.6.6/32     2.2.2.2                  0    100      0 66 i
*> 150.1.7.7/32     172.16.37.7              0             0 67 i

And the Customer1 routing table:

R7#sh ip route

Gateway of last resort is not set

     172.16.0.0/24 is subnetted, 1 subnets
C       172.16.37.0 is directly connected, Ethernet0/0
     150.1.0.0/32 is subnetted, 3 subnets
C       150.1.7.7 is directly connected, Loopback0
B       150.1.6.6 [20/0] via 172.16.37.3, 01:28:18
B       150.1.5.5 [20/0] via 172.16.37.3, 01:37:56
B       150.1.4.4 [20/0] via 172.16.37.3, 01:35:49

R7#ping 150.1.4.4 source 150.1.7.7
!!!!!
R7#ping 150.1.5.5 source 150.1.7.7
!!!!!
R7#ping 150.1.6.6 source 150.1.7.7
!!!!!

Now, what might happen if we put all customer’s sites into one autonomous system?

BGP has a loop prevention mechanism called AS_Path: If you see your own AS in an update, drop it… It’s a loop. Let’s try it and watch it in action:

PE Configuration

R2:
router bgp 666
no synchronization
bgp log-neighbor-changes
neighbor 3.3.3.3 remote-as 666
neighbor 3.3.3.3 update-source Loopback0
no auto-summary
!
address-family vpnv4
  neighbor 3.3.3.3 activate
  neighbor 3.3.3.3 send-community extended
exit-address-family
!
address-family ipv4 vrf CUSTOMER1
  neighbor 172.16.24.4 remote-as 69
  neighbor 172.16.24.4 activate
  neighbor 172.16.26.6 remote-as 69
  neighbor 172.16.26.6 activate
  no synchronization
  network 20.20.20.20 mask 255.255.255.255
exit-address-family

R3:

router bgp 666
no synchronization
bgp log-neighbor-changes
neighbor 2.2.2.2 remote-as 666
neighbor 2.2.2.2 update-source Loopback0
no auto-summary
!
address-family vpnv4
  neighbor 2.2.2.2 activate
  neighbor 2.2.2.2 send-community extended
exit-address-family
!
address-family ipv4 vrf CUSTOMER1
  neighbor 172.16.35.5 remote-as 69
  neighbor 172.16.35.5 activate
  neighbor 172.16.37.7 remote-as 69
  neighbor 172.16.37.7 activate
  no synchronization
  network 30.30.30.30 mask 255.255.255.255
exit-address-family

From PE’s point of view, there’s no problemo:

R3#sh ip bgp vpn vrf CUSTOMER1
BGP table version is 11, local router ID is 30.30.30.30

   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 3.3.3.3:1 (default for vrf CUSTOMER1)
*>i20.20.20.20/32   2.2.2.2                  0    100      0 i
*> 30.30.30.30/32   0.0.0.0                  0         32768 i
*>i150.1.4.4/32     2.2.2.2                  0    100      0 69 i
*> 150.1.5.5/32     172.16.35.5              0             0 69 i
*>i150.1.6.6/32     2.2.2.2                  0    100      0 69 i
*> 150.1.7.7/32     172.16.37.7              0             0 69 i

But look at CE (R4):

BGP(0): 172.16.24.2 rcv UPDATE about 150.1.7.7/32 — DENIED due to: AS-PATH contains our own AS;
BGP(0): 172.16.24.2 rcv UPDATE about 150.1.5.5/32 — DENIED due to: AS-PATH contains our own AS;
BGP(0): 172.16.24.2 rcv UPDATE about 150.1.6.6/32 — DENIED due to: AS-PATH contains our own AS;
BGP(0): Revise route installing 1 of 1 routes for 20.20.20.20/32 -> 172.16.24.2(main) to main IP table
BGP(0): Revise route installing 1 of 1 routes for 30.30.30.30/32 -> 172.16.24.2(main) to main IP table

R4#sh ip bgp
BGP table version is 4, local router ID is 150.1.4.4

   Network          Next Hop            Metric LocPrf Weight Path
*> 20.20.20.20/32   172.16.24.2              0             0 666 i
*> 30.30.30.30/32   172.16.24.2                            0 666 i
*> 150.1.4.4/32     0.0.0.0                  0         32768 i

CE does not accept routes to other CE routers as those are in its own AS. AS_PATH loop prevention method does not let them to install in RIB. There are two methods to solve this issue as workaround:

• BGP AS-Override
• BGP AllowAS-in

The first method replaces customer’s AS number with provider’s AS (by the PE).

The second method ignores own AS in AS_PATH (by CE).

Now, let’s try both:

BGP AS_Override

R2(config)#router bgp 666
R2(config-router)#add ipv4 vrf CUSTOMER1
R2(config-router-af)#neighbor 172.16.24.4 as-override
R2(config-router-af)#
%BGP-5-ADJCHANGE: neighbor 172.16.24.4 vpn vrf CUSTOMER1 Down AS-override change
%BGP-5-ADJCHANGE: neighbor 172.16.24.4 vpn vrf CUSTOMER1 Up

R4#sh ip bgp
BGP table version is 11, local router ID is 150.1.4.4
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
              r RIB-failure, S Stale
Origin codes: i – IGP, e – EGP, ? – incomplete

   Network          Next Hop    Metric LocPrf Weight Path
*> 20.20.20.20/32   172.16.24.2      0             0 666 i
*> 30.30.30.30/32   172.16.24.2                    0 666 i
*> 150.1.4.4/32     0.0.0.0          0         32768 i
*> 150.1.5.5/32     172.16.24.2                    0 666 666 i
*> 150.1.6.6/32     172.16.24.2                    0 666 666 i
*> 150.1.7.7/32     172.16.24.2                    0 666 666 i

BGP AllowAS_in

R5(config)#router bgp 69
R5(config-router)#neighbor 172.16.35.3 allowas-in
R5(config-router)#do cle ip bgp *
*Mar  3 07:48:05.946: %BGP-5-ADJCHANGE: neighbor 172.16.35.3 Down User reset
*Mar  3 07:48:06.918: %BGP-5-ADJCHANGE: neighbor 172.16.35.3 Up

R5(config-router)#^Z
R5#sh ip bgp
BGP table version is 7, local router ID is 150.1.5.5

   Network          Next Hop            Metric LocPrf Weight Path
*> 20.20.20.20/32   172.16.35.3                            0 666 i
*> 30.30.30.30/32   172.16.35.3              0             0 666 i
*> 150.1.4.4/32     172.16.35.3                            0 666 69 i
*> 150.1.5.5/32     0.0.0.0                  0         32768 i
*> 150.1.6.6/32     172.16.35.3                            0 666 69 i
*> 150.1.7.7/32     172.16.35.3                            0 666 69 i

AS_PATH loop prevention method is a good thing. When we ignore it, some bad things might happen to us… and BGP Site of Origin is introduced… BGP SOO keeps track of updates and the location that they are originated from, in an extended community, just like EIGRP SOO that we covered earlier.

BGP SOO is an extended community that helps us to prevent loop and suboptimal routing especially when a backdoor link is present in the network. We set it on PE routers as ingress route-map inside BGP configuration. If you want to do this for other routing protocols, you have to set it on interface with ip vrf site-map command.

R3(config)#route-map SOO
R3(config-route-map)#set extcommunity soo 666:1
R3(config-route-map)#router bgp 666
R3(config-router)#address-family ipv4 vrf CUSTOMER1
R3(config-router-af)#neighbor 172.16.35.5 route-map SOO in

…

R2#sh ip bgp vpnv4 all 150.1.5.5
BGP routing table entry for 2.2.2.2:1:150.1.5.5/32, version 58
Paths: (1 available, best #1, table CUSTOMER1)
Flag: 0×820
  Advertised to update-groups:
     2          3        
  69, imported path from 3.3.3.3:1:150.1.5.5/32
    3.3.3.3 (metric 31) from 3.3.3.3 (3.3.3.3)
      Origin IGP, metric 0, localpref 100, valid, internal, best
      Extended Community: SoO:666:1 RT:666:1
      mpls labels in/out nolabel/23

Note: Don’t forget to set BGP SOO at each ingress point at each PE per CE neighbor.

Once upon a time there was RIP and not so many problems with its simplicity! Nowadays networks are larger in scale and more complex in action, convergence time and redundancy are more important than ever. It’s not too bad, lots of fun for us… Once the customers want to use OSPF on C Routers, we have to provide OSPF on each PE and span customer area across MPLS backbone. It’s not difficult but there were some conceptual problems at first! Consistency of area LSAs while we are redistributing them on each PE router from OSPF to BGP and vice versa became an issue… Routes inside an area became IA (Inter-Area) across the MPLS network, reported by LSA type 3 network summary.

The Solution is simple, extend the customer backbone area across MPLS backbone using some virtual links… called “Sham Link”. Sham links help us to deliver routes as intra-area – regular routes – not the inter-area, resulting in better route selection. OSPF prefers intra-area routes to inter-area then external and after all NSSA external routes so it’s important to have routes as intra-area inside one area… Now let’s bring an example and the interesting part of configuration:

Customer1, our favorite customer has 4 sites and area 0 is used and configured on all CE routers. Our mission is to make them connected to work! Now let’s start it without sham links and see what might happen. Configuration on CE routers:

router ospf 100
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0

Note1: By default OSPF external routes are not redistributed using “redistributed ospf”. Make sure to include the “external” keyword while configuring redistribution.

Note2: By default OSPF Domain-ID equals to Process-ID, so routers with same Process-ID are considered to be in same OSPF domain. When you use different OSPF Process-IDs make sure to modify Domain-ID to be equal between neighbors, unless you want to have your routes treated as the External-Type-2 for other OSPF routers in different domain.

PE Configuration:

router ospf 666 vrf CUSTOMER1
domain-id 0.0.0.10
redistribute bgp 666 subnets
network 172.16.0.0 0.0.255.255 area 0
!
router bgp 666
no synchronization
neighbor 3.3.3.3 remote-as 666
neighbor 3.3.3.3 update-source Loopback0
no auto-summary
!
address-family vpnv4
  neighbor 3.3.3.3 activate
  neighbor 3.3.3.3 send-community extended
exit-address-family
!       
address-family ipv4 vrf CUSTOMER1
  redistribute ospf 666 vrf CUSTOMER1 match internal external 1 external 2
  no synchronization
exit-address-family

R2#sh ip route vrf CUSTOMER1

     172.16.0.0/24 is subnetted, 5 subnets
B       172.16.45.0 [200/110] via 3.3.3.3, 00:02:52
B       172.16.37.0 [200/0] via 3.3.3.3, 00:02:52
B       172.16.35.0 [200/0] via 3.3.3.3, 00:02:52
C       172.16.24.0 is directly connected, Ethernet0/2
C       172.16.26.0 is directly connected, Ethernet0/1
     150.1.0.0/32 is subnetted, 4 subnets
B       150.1.7.7 [200/11] via 3.3.3.3, 00:02:52
O       150.1.6.6 [110/11] via 172.16.26.6, 00:03:07, Ethernet0/1
B       150.1.5.5 [200/11] via 3.3.3.3, 00:02:52
O       150.1.4.4 [110/11] via 172.16.24.4, 00:03:07, Ethernet0/2

R4#sh ip route

     172.16.0.0/24 is subnetted, 5 subnets
O IA    172.16.45.0 [110/120] via 172.16.24.2, 00:04:05, Ethernet0/0
O IA    172.16.37.0 [110/11] via 172.16.24.2, 00:04:05, Ethernet0/0
O IA    172.16.35.0 [110/11] via 172.16.24.2, 00:04:05, Ethernet0/0
C       172.16.24.0 is directly connected, Ethernet0/0
O       172.16.26.0 [110/20] via 172.16.24.2, 00:04:06, Ethernet0/0
     150.1.0.0/32 is subnetted, 4 subnets
O IA    150.1.7.7 [110/21] via 172.16.24.2, 00:04:06, Ethernet0/0
O       150.1.6.6 [110/21] via 172.16.24.2, 00:04:06, Ethernet0/0
O IA    150.1.5.5 [110/21] via 172.16.24.2, 00:04:05, Ethernet0/0
C       150.1.4.4 is directly connected, Loopback0

But once we connect the backdoor link between R4 and R5:

R4(config)#int e 0/3
R4(config-if)#no shut
%LINK-3-UPDOWN: Interface Ethernet0/3, changed state to up

R4(config-if)#ip os cost 100
R4(config-if)#do sh ip route

     172.16.0.0/24 is subnetted, 5 subnets
C       172.16.45.0 is directly connected, Ethernet0/3
O       172.16.37.0 [110/120] via 172.16.45.5, 00:00:22, Ethernet0/3
O       172.16.35.0 [110/110] via 172.16.45.5, 00:00:22, Ethernet0/3
C       172.16.24.0 is directly connected, Ethernet0/0
O       172.16.26.0 [110/20] via 172.16.24.2, 00:00:22, Ethernet0/0
     150.1.0.0/32 is subnetted, 4 subnets
O       150.1.7.7 [110/121] via 172.16.45.5, 00:00:22, Ethernet0/3
O       150.1.6.6 [110/21] via 172.16.24.2, 00:00:22, Ethernet0/0
O       150.1.5.5 [110/101] via 172.16.45.5, 00:00:22, Ethernet0/3
C       150.1.4.4 is directly connected, Loopback0

Even after increasing the backdoor cost by ‘ip ospf cost’ command, routes through backdoor are prefered, why? Because intra-area routes are better than inter-area routes regardless of metric.  Now the magical ‘sham-link’ comes into the play:

R2:

R2(config)#int loopback 1
%LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to up

R2(config-if)#ip address 20.20.20.20 255.255.255.255
R2(config-if)#router bgp 666
R2(config-router)#address-family ipv4 vrf CUSTOMER1
R2(config-router-af)#network 20.20.20.20 mask 255.255.255.255
R2(config-router-af)#exit
R2(config-router)#router ospf 666 vrf CUSTOMER1
R2(config-router)#area 0 sham-link 20.20.20.20 30.30.30.30

%OSPF-5-ADJCHG: Process 666, Nbr 172.16.37.3 on OSPF_SL0 from LOADING to FULL, Loading Done

R2#sh ip os 666 sham
Sham Link OSPF_SL0 to address 30.30.30.30 is up
Area 0 source address 20.20.20.20
  Run as demand circuit
  DoNotAge LSA allowed. Cost of using 1 State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40,
    Hello due in 00:00:02
    Adjacency State FULL (Hello suppressed)
    Index 3/3, retransmission queue length 0, number of retransmission 2
    First 0×0(0)/0×0(0) Next 0×0(0)/0×0(0)
    Last retransmission scan length is 1, maximum is 6
    Last retransmission scan time is 0 msec, maximum is 0 msec

R2#sh ip route vrf CUSTOMER1

     20.0.0.0/32 is subnetted, 1 subnets
C       20.20.20.20 is directly connected, Loopback1
     172.16.0.0/24 is subnetted, 5 subnets
O       172.16.45.0 [110/110] via 172.16.24.4, 00:02:00, Ethernet0/2
O       172.16.37.0 [110/11] via 3.3.3.3, 00:02:00
O       172.16.35.0 [110/11] via 3.3.3.3, 00:02:00
C       172.16.24.0 is directly connected, Ethernet0/2
C       172.16.26.0 is directly connected, Ethernet0/1
     150.1.0.0/32 is subnetted, 4 subnets
O       150.1.7.7 [110/12] via 3.3.3.3, 00:02:00
O       150.1.6.6 [110/11] via 172.16.26.6, 00:02:00, Ethernet0/1
O       150.1.5.5 [110/12] via 3.3.3.3, 00:02:01
O       150.1.4.4 [110/11] via 172.16.24.4, 00:02:01, Ethernet0/2
     30.0.0.0/32 is subnetted, 1 subnets
B       30.30.30.30 [200/0] via 3.3.3.3, 00:03:09

R4#show ip route

     20.0.0.0/32 is subnetted, 1 subnets
O E2    20.20.20.20 [110/1] via 172.16.24.2, 00:02:34, Ethernet0/0
     172.16.0.0/24 is subnetted, 5 subnets
C       172.16.45.0 is directly connected, Ethernet0/3
O       172.16.37.0 [110/21] via 172.16.24.2, 00:02:34, Ethernet0/0
O       172.16.35.0 [110/21] via 172.16.24.2, 00:02:34, Ethernet0/0
C       172.16.24.0 is directly connected, Ethernet0/0
O       172.16.26.0 [110/20] via 172.16.24.2, 00:02:34, Ethernet0/0
     150.1.0.0/32 is subnetted, 4 subnets
O       150.1.7.7 [110/22] via 172.16.24.2, 00:02:34, Ethernet0/0
O       150.1.6.6 [110/21] via 172.16.24.2, 00:02:34, Ethernet0/0
O       150.1.5.5 [110/22] via 172.16.24.2, 00:02:34, Ethernet0/0
C       150.1.4.4 is directly connected, Loopback0
     30.0.0.0/32 is subnetted, 1 subnets
O E2    30.30.30.30 [110/1] via 172.16.24.2, 00:02:35, Ethernet0/0

R3:

interface Loopback0
ip address 3.3.3.3 255.255.255.255
!
interface Loopback1
ip vrf forwarding CUSTOMER1
ip address 30.30.30.30 255.255.255.255
!
interface Ethernet0/0
ip address 172.16.30.3 255.255.255.0
!
interface Ethernet0/1
ip vrf forwarding CUSTOMER1
ip address 172.16.35.3 255.255.255.0
!
interface Ethernet0/2
ip vrf forwarding CUSTOMER1
ip address 172.16.37.3 255.255.255.0
!
router ospf 666 vrf CUSTOMER1
domain-id 0.0.0.10
log-adjacency-changes
area 0 sham-link 30.30.30.30 20.20.20.20
redistribute bgp 666 subnets
network 172.16.0.0 0.0.255.255 area 0
!
router ospf 1
mpls ldp autoconfig area 0
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0
!
router bgp 666
no synchronization
bgp log-neighbor-changes
neighbor 1.1.1.1 remote-as 666
neighbor 1.1.1.1 update-source Loopback0
neighbor 2.2.2.2 remote-as 666
neighbor 2.2.2.2 update-source Loopback0
no auto-summary
!
address-family vpnv4
  neighbor 1.1.1.1 activate
  neighbor 1.1.1.1 send-community extended
  neighbor 2.2.2.2 activate
  neighbor 2.2.2.2 send-community extended
exit-address-family
!
address-family ipv4 vrf CUSTOMER1
  redistribute ospf 666 vrf CUSTOMER1 match internal external 1 external 2
  no synchronization
  network 30.30.30.30 mask 255.255.255.255
exit-address-family
!

R3#show ip ospf 666 neighbor

Neighbor ID   Pri   State      Dead Time   Address       Interface
150.1.7.7       1   FULL/DR    00:00:34    172.16.37.7   Ethernet0/2
150.1.5.5       1   FULL/DR    00:00:36    172.16.35.5   Ethernet0/1
172.16.26.2     0   FULL/  -      -        20.20.20.20   OSPF_SL0

Final Note: The sham link source and destination should not be included in OSPF network that’s why we are advertising them in BGP domain.