Configuring Hub & Spoke
In hub and spoke networking, an access control device is specified in the VPN, and users communicate with each other through the access control device.
Usage Scenario
If it is required that an access control device be specified in the VPN and all the users access the VPN through this access control device, you can deploy the hub & spoke networking so that all the data exchanged between spoke sites flow through the hub site.
The Hub-CE accesses the Hub-PE through dual links. On the network shown in Figure 1, traffic between Site 1 and Site 2 of VPN1 needs to pass through Site 3. The Hub-PE and the Hub-CE are connected through two links. The Hub-PE has two VPN instances configured, vpn_in and vpn_out, which are bound to the corresponding AC interfaces. vpn-in receives and maintains all the VPNv4 routes advertised by the Spoke-PEs. vpn-out maintains routes from the hub site and all the spoke sites and advertises them to all the Spoke-PEs.
The Hub-CE accesses the Hub-PE through a single link. On the network shown in Figure 2, traffic between Site 1 and Site 2 of VPN1 needs to pass through Site 3. The Hub-PE and the Hub-CE are connected through a single link. The Hub-PE has only one VPN instance configured, vpnhub, which is bound to the AC interface connecting to the Hub-CE. Additionally, the apply-label per-route pop-go command needs to be run in the VPN instance view to configure the Hub-PE to directly search the label mapping table for the outbound interface for forwarding after receiving data packets from the Spoke-PEs.
Pre-configuration Tasks
Before configuring hub & spoke, complete the following tasks:
Configure an IGP on the MPLS backbone network to ensure IP connectivity on the backbone network.
Configure MPLS both globally and per interface on each node of the backbone network and establish an LDP LSP between PEs.
Configure an IP address for the interface connecting a CE to a PE.
- Configuring a VPN Instance
- A VPN instance can be configured on a PE to manage VPN routes.
- Binding an Interface to a VPN Instance
- By binding an interface to a VPN instance, you can change the interface to be a VPN interface. Then, packets entering this interface are forwarded according to the forwarding information of the VPN instance.
- Configuring Route Exchange Between a Hub-PE and a Spoke-PE
- By introducing extended community attributes into BGP, MP-IBGP can advertise VPNv4 routes between PEs.
- Configuring Route Exchange Between a PE and a CE
- The routing protocol running between a PE and a CE can be BGP or an IGP. A static route (including the default route) can also run between them. You can choose any of them as required.
- Verifying the Hub and Spoke Configuration
- After configuring hub & spoke, check VPN routing information on the PE or CE.