Juniper BGP Confederation MPLS/VPN

BGP Confederation MPLS/VPN

BGP Summary
root@Olive# run show bgp summary logical-system r1
Groups: 2 Peers: 3 Down peers: 0
Table          Tot Paths  Act Paths Suppressed    History Damp State    Pending
inet.0                 0          0          0          0          0          0
Peer                     AS      InPkt     OutPkt    OutQ   Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
3.3.3.3               65413         10         11       0       0        3:30 0/0/0/0              0/0/0/0
192.168.12.2          65412         34         49       0       7           4 0/0/0/0              0/0/0/0
192.168.16.6          65414          3          2       0       1           4 0/0/0/0              0/0/0/0

R1 didn’t receive any VPN routes from other PE's, because PE will install CE’s VPN routes in vpn-a.inet.0 routing table, but now PE only advertise IPv4 IBGP peer to R1, they don’t use MP-BGP.
All PE's can learn all VPNv4 routes in this case, So the IGP must be enable in all PE's, but PE don’t
have routes to another PE. Enable OSPF in all routers within AS. Make sure it can reachable in each PE.

root@Olive# show r1 protocols ospf  
area 0.0.0.0 {
    interface lo0.1 {
        passive;
    }
    interface em1.13;
    interface em1.12;
    interface em1.16;
}

root@Olive# show r2 protocols ospf   
area 0.0.0.0 {
    interface lo0.2 {
        passive;
    }
    interface em2.12;
}

root@Olive# show r3 protocols ospf  
area 0.0.0.0 {
    interface lo0.3 {
        passive;
    }
    interface em2.13;
}

root@Olive# show r6 protocols ospf   
area 0.0.0.0 {
    interface lo0.6 {
        passive;
    }
    interface em2.16;
}

Configuration MP-IBGP between in PE's, three PE's belong to different AS, Enable Multi-hop and group type external.

root@Olive# show r2 protocols bgp
group ebgp {
    type external;
    neighbor 192.168.12.1 {
        peer-as 65413;
    }
}
group vpn-pe {
    type external;
    local-address 2.2.2.2;
    family inet-vpn {
        unicast;
    }
    neighbor 3.3.3.3 {
        multihop;
        peer-as 65413;
    }
    neighbor 6.6.6.6 {
        multihop;
        peer-as 65414;
    }
}

root@Olive# show r3 protocols bgp  
group ibgp {
    type internal;
    local-address 3.3.3.3;
    neighbor 1.1.1.1;
}
group vpn-pe {
    type external;
    local-address 3.3.3.3;
    family inet-vpn {
        unicast;
    }
    neighbor 2.2.2.2 {
        multihop;
        peer-as 65412;
    }
    neighbor 6.6.6.6 {
        multihop;
        peer-as 65414;
    }
}

root@Olive# show r6 protocols bgp  
group ebgp {
    type external;
    neighbor 192.168.16.1 {
        peer-as 65413;
    }
}
group vpn-pe {
    type external;
    local-address 6.6.6.6;
    family inet-vpn {
        unicast;
    }
    neighbor 2.2.2.2 {
        multihop;
        peer-as 65412;
    }
    neighbor 3.3.3.3 {
        multihop;
        peer-as 65413;
    }
}

Check the BGP Summary
root@Olive# run show bgp summary logical-system r3   
Groups: 3 Peers: 4 Down peers: 0
Table          Tot Paths  Act Paths Suppressed    History Damp State    Pending
bgp.l3vpn.0            5          1          0          0          0          0
inet.0                 0          0          0          0          0          0
Peer                     AS      InPkt     OutPkt    OutQ   Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
1.1.1.1               65413         56         58       0       0       24:47 Establ
  inet.0: 0/0/0/0
2.2.2.2               65412          5          5       0       0          17 Establ
  bgp.l3vpn.0: 0/2/2/0
  vpn-a.inet.0: 0/2/2/0
6.6.6.6               65414          4          4       0       0          13 Establ
  bgp.l3vpn.0: 0/2/2/0
  vpn-a.inet.0: 0/2/2/0
192.168.35.5            500         43         46       0      10          56 Establ
  vpn-a.inet.0: 1/2/2/0

R3 was received the VPNv4 routes from R2 and R6, but the route is inactive.
root@Olive1# run show route hidden logical-system r3

inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)

inet.3: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)

vpn-a.inet.0: 7 destinations, 8 routes (3 active, 0 holddown, 4 hidden)
+ = Active Route, - = Last Active, * = Both

4.4.4.4/32          [BGP/170] 00:01:38, localpref 100, from 2.2.2.2
                      AS path: (65412) 400 I
                      Unusable
7.7.7.7/32          [BGP/170] 00:01:34, localpref 100, from 6.6.6.6
                      AS path: (65414) 700 I
                      Unusable
192.168.24.0/24     [BGP/170] 00:01:38, localpref 100, from 2.2.2.2
                      AS path: (65412) I
                      Unusable
192.168.67.0/24     [BGP/170] 00:01:34, localpref 100, from 6.6.6.6
                      AS path: (65414) I
                      Unusable

mpls.0: 6 destinations, 6 routes (6 active, 0 holddown, 0 hidden)

bgp.l3vpn.0: 6 destinations, 6 routes (2 active, 0 holddown, 4 hidden)
+ = Active Route, - = Last Active, * = Both

100:1:4.4.4.4/32               
                    [BGP/170] 00:01:38, localpref 100, from 2.2.2.2
                      AS path: (65412) 400 I
                      Unusable
100:1:7.7.7.7/32               
                    [BGP/170] 00:01:34, localpref 100, from 6.6.6.6
                      AS path: (65414) 700 I
                      Unusable
100:1:192.168.24.0/24               
                    [BGP/170] 00:01:38, localpref 100, from 2.2.2.2
                      AS path: (65412) I
                      Unusable
100:1:192.168.67.0/24               
                    [BGP/170] 00:01:34, localpref 100, from 6.6.6.6
                      AS path: (65414) I
                      Unusable

The route information: Unsable, it means can’t reach next-hop in normal,
Check 7.7.7.7/32 route next-hop information
root@Olive1# run show route 7.7.7.7/32 logical-system r3 hidden extensive

vpn-a.inet.0: 7 destinations, 8 routes (3 active, 0 holddown, 4 hidden)
7.7.7.7/32 (1 entry, 0 announced)
         BGP    Preference: 170/-101
                Route Distinguisher: 100:1
                Next hop type: Unusable
                Next-hop reference count: 8
                State:
< output omitted >

The VPNv4 route 7.7.7.7/32 next hop is R6(PE), and PE Loopback route in inet.3 route table, inet.3 route table in R3

root@Olive1# run show route table inet.3 logical-system r3          

inet.3: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

1.1.1.1/32         *[LDP/9] 00:12:57, metric 1
                    > to 192.168.13.1 via em2.13

Enable LDP protocol between in EBGP interfaces
root@Olive# set r1 protocols ldp interface em1.12
root@Olive# set r1 protocols ldp interface em1.13

root@Olive# set r1 protocols ldp interface em1.16

root@Olive# set r3 protocols ldp interface em2.13
root@Olive# set r2 protocols ldp interface em2.12
root@Olive# set r6 protocols ldp interface em2.16

Inet.3 Route table

root@Olive# run show route table inet.3 logical-system r3  

inet.3: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

1.1.1.1/32         *[LDP/9] 00:01:43, metric 1
                    > to 192.168.13.1 via em2.13
2.2.2.2/32         *[LDP/9] 00:01:43, metric 1
                    > to 192.168.13.1 via em2.13, Push 300160
6.6.6.6/32         *[LDP/9] 00:01:43, metric 1
                    > to 192.168.13.1 via em2.13, Push 300192

VPNv4 Route
root@Olive# run show route 7.7.7.7/32 logical-system r3   

vpn-a.inet.0: 7 destinations, 11 routes (7 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

7.7.7.7/32         *[BGP/170] 00:00:01, localpref 100, from 6.6.6.6
                      AS path: (65414) 700 I
                    > to 192.168.13.1 via em2.13, Push 16, Push 300192(top)

bgp.l3vpn.0: 6 destinations, 9 routes (6 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

100:1:7.7.7.7/32               
                   *[BGP/170] 00:00:01, localpref 100, from 6.6.6.6
                      AS path: (65414) 700 I
                    > to 192.168.13.1 via em2.13, Push 16, Push 300192(top)

R3 to 7.7.7.7/32 will push outside label 300192 from R1, and VPN label 16 at the same time.
Check label 300192 in R1

root@Olive# run show route table mpls.0 label 300192 logical-system r1   

mpls.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

300192             *[LDP/9] 00:03:25, metric 1
                    > to 192.168.16.6 via em1.16, Pop     
300192(S=0)        *[LDP/9] 00:03:25, metric 1
                    > to 192.168.16.6 via em1.16, Pop      

R1 will pop outside label and send VPN label 16 to R6
Check ping reachable

root@Olive# run show route label 16 logical-system r6          

mpls.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

16                 *[VPN/0] 01:41:48
                      to table vpn-a.inet.0, Pop    

root@Olive# run show route protocol bgp logical-system r5         

inet.0: 7 destinations, 7 routes (7 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

4.4.4.4/32         *[BGP/170] 00:04:27, localpref 100
                      AS path: 100 400 I
                    > to 192.168.35.3 via em2.35
7.7.7.7/32         *[BGP/170] 00:04:27, localpref 100
                      AS path: 100 700 I
                    > to 192.168.35.3 via em2.35
192.168.24.0/24    *[BGP/170] 00:04:27, localpref 100
                      AS path: 100 I
                    > to 192.168.35.3 via em2.35
192.168.67.0/24    *[BGP/170] 00:04:27, localpref 100
                      AS path: 100 I
                    > to 192.168.35.3 via em2.35

root@Olive# run show route protocol bgp logical-system r4        

inet.0: 7 destinations, 7 routes (7 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

5.5.5.5/32         *[BGP/170] 00:04:54, localpref 100
                      AS path: 100 500 I
                    > to 192.168.24.2 via em2.24
7.7.7.7/32         *[BGP/170] 00:04:54, localpref 100
                      AS path: 100 700 I
                    > to 192.168.24.2 via em2.24
192.168.35.0/24    *[BGP/170] 00:04:54, localpref 100
                      AS path: 100 I
                    > to 192.168.24.2 via em2.24
192.168.67.0/24    *[BGP/170] 00:04:54, localpref 100
                      AS path: 100 I
                    > to 192.168.24.2 via em2.24

root@Olive# run ping 7.7.7.7 logical-system r5 source 5.5.5.5 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.417/4.011/5.861/1.505 ms

root@Olive# run ping 4.4.4.4 logical-system r5 source 5.5.5.5 rapid
PING 4.4.4.4 (4.4.4.4): 56 data bytes
!!!!!
--- 4.4.4.4 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.773/2.789/3.470/0.594 ms

Juniper BGP Route Reflector MPLS/VPN

BGP Route Reflector MPLS/VPN

The IBGP neighbor is configured among the 3 PE's and RR. The cluster-id of RR is 1.1.1.1.
There are two path from R3 to 7.7.7.7/32, and R3 chooses the path via R2 to the next hop R6, and R6 chooses RR to the next hop of R3 VPN route.
Why not all the path via RR ? The reason is that RR just advertise VPNv4 route to PE.
When PE received the VPN route from VPN RR, it will check the next-hop of PE lo0 interface address in inet.3 route table. If using LDP for MPLS signal, the path of inet.3 route item will depend on inet.0 route table, it means if IGP path use R3-R2-R6，VPNv4 path will use the same IGP path. In this case R3 to R6 will across R1 or R2 in random.
In order to know the result more clearly, check the path from R2 to 7.7.7.7/32.

root@Olive# run show route 7.7.7.7/32 logical-system r2 detail 

< output omitted >

bgp.l3vpn.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden)

100:1:7.7.7.7/32 (1 entry, 0 announced)
        *BGP    Preference: 170/-101
                Route Distinguisher: 100:1
                Next hop type: Indirect
                Next-hop reference count: 6
                Source: 1.1.1.1
                Next hop type: Router, Next hop index: 1075
                Next hop: 192.168.26.6 via em1.26, selected
                Label operation: Push 16
                Label TTL action: prop-ttl
                Protocol next hop: 6.6.6.6
                Push 16
                Indirect next hop: 8f845a0 131075
                State:
                Local AS:   100 Peer AS:   100
                Age: 4:04       Metric2: 1
                Task: BGP_100.1.1.1.1+179
                AS path: 700 I (Originator) Cluster list:  1.1.1.1
                AS path:  Originator ID: 6.6.6.6
                Communities: target:100:1
                Import Accepted
                VPN Label: 16
                Localpref: 100
                Router ID: 1.1.1.1
                Secondary Tables: vpn-a.inet.0

The traffic not always via RR, but to the next-hop PE of VPN route by the IGP shortest path, and the next-hop is not RR as well. R2 transfer traffic to R6 directly, check the label on R6.

root@Olive# run show route label 16 logical-system r6

mpls.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

16                 *[VPN/0] 00:12:42
                      to table vpn-a.inet.0, Pop

The function of RR is just advertise the VPNv4 routing to all PE's belong to this cluster, and will not change the next-hop (Because there is no any VPN customer on RR, and it can’t generate VPN label,
and can’t work as VPNv4 next-hop as well).
Check the BPG neighbor summary information on R2, there is no IBGP neighbor relationship between R2 and R6.
It means that the routing control plane is transferred by RR, but R2 not learn from R6 in directly. While in forwarding plane, it will not via RR, and transferred to R6 directly.

root@Olive# run show bgp summary logical-system r2
Groups: 2 Peers: 2 Down peers: 0
Table          Tot Paths  Act Paths Suppressed    History Damp State    Pending
bgp.l3vpn.0            4          4          0          0          0          0
Peer                     AS      InPkt     OutPkt    OutQ   Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
1.1.1.1                 100         42         42       0       0       16:56 Establ
  bgp.l3vpn.0: 4/4/4/0
  vpn-a.inet.0: 4/4/4/0
192.168.24.4            400         44         47       0       0       18:07 Establ
  vpn-a.inet.0: 1/2/2/0

The reachable between CE's

root@Olive# run ping 7.7.7.7 logical-system r4 source 4.4.4.4 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.792/1.219/2.385/0.593 ms

root@Olive# run ping 5.5.5.5 logical-system r4 source 4.4.4.4 rapid
PING 5.5.5.5 (5.5.5.5): 56 data bytes
!!!!!
--- 5.5.5.5 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.502/3.315/4.997/1.165 ms

Juniper LDP over RSVP Tunnel MPLS/VPN

LDP over RSVP Tunnel MPLS

Create RSVP LSP between R6 and r7, make sure the LDP signal can across the RSVP LSP

root@Olive# show r6 protocols                       

rsvp {

    interface em2.16;

}

mpls {

    label-switched-path r6-r7 {

        to 7.7.7.7;

        ldp-tunneling;

    }

    interface em2.16;

    interface em2.26;

}

ospf {

    traffic-engineering;

    area 0.0.0.0 {

        interface all;

        interface lo0.6 {

            passive;

        }

    }

}

ldp {

    interface em2.26;

    interface lo0.6;

}

root@Olive# show r7 protocols    

rsvp {

    interface em2.17;

}

mpls {

    label-switched-path r7-r6 {

        to 6.6.6.6;

        ldp-tunneling;

    }

    interface em2.17;

    interface em2.37;

}

ospf {

    traffic-engineering;

    area 0.0.0.0 {

        interface all;

        interface lo0.7 {

            passive;

        }

    }

}

ldp {

    interface em2.37;

    interface lo0.7;

}

Enable OSPF TE on r1

root@Olive# run show mpls lsp logical-system r6   
Ingress LSP: 1 sessions
To              From            State Rt P     ActivePath       LSPname
7.7.7.7         6.6.6.6         Up     0 *                      r6-r7
Total 1 displayed, Up 1, Down 0

Egress LSP: 1 sessions
To              From            State   Rt Style Labelin Labelout LSPname
6.6.6.6         7.7.7.7         Up       0  1 FF       3        - r7-r6
Total 1 displayed, Up 1, Down 0

Transit LSP: 0 sessions
Total 0 displayed, Up 0, Down 0

CE Routing Table

root@Olive# run show route protocol ospf logical-system r4

inet.0: 6 destinations, 6 routes (6 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

5.5.5.5/32         *[OSPF/10] 00:23:51, metric 2
                    > to 192.168.24.2 via em2.24
192.168.35.0/24    *[OSPF/150] 00:23:51, metric 0, tag 3489661028
                    > to 192.168.24.2 via em2.24
224.0.0.5/32       *[OSPF/10] 00:25:33, metric 1
                      MultiRecv

root@Olive# run ping 5.5.5.5 logical-system r4 source 4.4.4.4 rapid
PING 5.5.5.5 (5.5.5.5): 56 data bytes
!!!!!
--- 5.5.5.5 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.000/2.671/4.021/0.845 ms

Check label from R2 To 5.5.5.5

root@Olive# run show route table vpn-a.inet.0 5.5.5.5/32 logical-system r2 detail | match "Label|Protocol next hop" 
                Label operation: Push 16, Push 299808(top)
                Label TTL action: prop-ttl, prop-ttl(top)
                Protocol next hop: 3.3.3.3
                VPN Label: 16

root@Olive# run show route table inet.3 3.3.3.3/32 logical-system r2 detail

inet.3: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
3.3.3.3/32 (1 entry, 1 announced)
        State:
        *LDP    Preference: 9
                Next hop type: Router
                Next-hop reference count: 2
                Next hop: 192.168.26.6 via em1.26, selected
                Label operation: Push 299808
                Label TTL action: prop-ttl
                State:
                Local AS:   100
                Age: 27:19      Metric: 1
                Task: LDP
                Announcement bits (1): 2-Resolve tree 1
                AS path: I

The label 16 is VPN label which is generate by R3, and the outside lebel is 299808 that is generated
by R6.
Check the label 299808 on R6.

root@Olive# run show route label 299808 logical-system r6 detail

mpls.0: 7 destinations, 7 routes (7 active, 0 holddown, 0 hidden)
299808 (1 entry, 1 announced)
        *LDP    Preference: 9
                Next hop type: Router, Next hop index: 1033
                Next-hop reference count: 2
                Next hop: 192.168.16.1 via em2.16 weight 0x1, selected
                Label-switched-path r6-r7
                Label operation: Swap 299776, Push 299792(top)
                Label TTL action: prop-ttl, prop-ttl(top)
                State:
                Age: 30:51      Metric: 1
                Task: LDP
                Announcement bits (1): 1-KRT
                AS path: I
                Prefixes bound to route: 3.3.3.3/32

R6 swap the label into 299776, and this swap label is distributed by R7 RSVP LSP.
And R6 will distribute outside label 299776 for r7, and this one is distributed by R1.
root@Olive# run show route label 299776 logical-system r1 detail     

mpls.0: 7 destinations, 7 routes (7 active, 0 holddown, 0 hidden)
299776 (1 entry, 1 announced)
        *RSVP   Preference: 7/1
                Next hop type: Router, Next hop index: 1027
                Next-hop reference count: 3
                Next hop: 192.168.16.6 via em1.16 weight 0x1, selected
                Label-switched-path r7-r6
                Label operation: Pop     
                State:
                Local AS:   100
                Age: 33:20      Metric: 1
                Task: RSVP
                Announcement bits (1): 1-KRT
                AS path: I

R1 will pop the label 299776 once it receive it. Then forward the label 299776 to R7.

root@Olive# run show route label 299776 logical-system r1 detail     

mpls.0: 7 destinations, 7 routes (7 active, 0 holddown, 0 hidden)
299776 (1 entry, 1 announced)
        *RSVP   Preference: 7/1
                Next hop type: Router, Next hop index: 1027
                Next-hop reference count: 3
                Next hop: 192.168.16.6 via em1.16 weight 0x1, selected
                Label-switched-path r7-r6
                Label operation: Pop     
                State:
                Local AS:   100
                Age: 38:29      Metric: 1
                Task: RSVP
                Announcement bits (1): 1-KRT
                AS path: I

R1 will pop the label 299776 once it receive it. Then forward the label 299776 to R7.
root@Olive# run show route label 299776 logical-system r7 detail     

mpls.0: 7 destinations, 7 routes (7 active, 0 holddown, 0 hidden)
299776 (1 entry, 1 announced)
        *LDP    Preference: 9
                Next hop type: Router, Next hop index: 1023
                Next-hop reference count: 2
                Next hop: 192.168.37.3 via em2.37, selected
                Label operation: Pop     
                State:
                Age: 39:14      Metric: 1
                Task: LDP
                Announcement bits (1): 1-KRT
                AS path: I
                Prefixes bound to route: 3.3.3.3/32

R7 will pop the label 299776 once it receive, and then forward the only one layer VPN label l6 to R3.

root@Olive# run show route label 16 logical-system r3

mpls.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

16                 *[VPN/0] 00:45:55
                      to table vpn-a.inet.0, Pop

Juniper Overlay MPLS VPN

Overlay MPLS VPN

Just as vpn-a, vpn-b, vpn-ab, instance_name.inet.0 means routing-instance routing table.
The different instance routing table need to learn routing of each others,
Therefore routing import must among there, and this could be realize by configure routing table group.
As the following, vpn-a.inet.0 and vpn-b.inet.0 routing table was imported into vpn-ab.inet.0

root@Olive# show r1 routing-options
rib-groups {
    vpn-a-ab {
        import-rib [ vpn-a.inet.0 vpn-ab.inet.0 ];
    }
    vpn-b-ab {
        import-rib [ vpn-b.inet.0 vpn-ab.inet.0 ];
    }
    vpn-a-b-ab {
        import-rib [ vpn-ab.inet.0 vpn-a.inet.0 vpn-b.inet.0 ];
    }
}
autonomous-system 100;

Next apply different rib-group to related routing-instance, here's the static route is used as the routing
between PE-CE. Different with general, although in this simulation have applyed rib-groups for import the routes from another instance, but need to create static route to another instance.

root@Olive# show r1 routing-instances
vpn-a {
    instance-type vrf;
    interface em1.16;
    route-distinguisher 100:1;
    vrf-import vpn-a-import;
    vrf-export vpn-a-export;
    vrf-table-label;
    routing-options {
        interface-routes {
            rib-group inet vpn-a-ab;
        }
        static {
            route 6.6.6.6/32 next-hop 192.168.16.6;
            route 7.7.7.7/32 next-hop 192.168.17.7;
        }
    }
}
vpn-ab {
    instance-type vrf;
    interface em1.17;
    route-distinguisher 100:3;
    vrf-import vpn-ab-import;
    vrf-export vpn-ab-export;
    vrf-table-label;
    routing-options {
        interface-routes {
            rib-group inet vpn-a-b-ab;
        }
        static {
            route 6.6.6.6/32 next-hop 192.168.16.6;
            route 7.7.7.7/32 next-hop 192.168.17.7;
            route 8.8.8.8/32 next-hop 192.168.18.8;
        }
    }
}
vpn-b {
    instance-type vrf;
    interface em1.18;
    route-distinguisher 100:2;
    vrf-import vpn-b-import;
    vrf-export vpn-b-export;
    vrf-table-label;
    routing-options {
        interface-routes {
            rib-group inet vpn-b-ab;
        }
        static {                       
            route 7.7.7.7/32 next-hop 192.168.17.7;
            route 8.8.8.8/32 next-hop 192.168.18.8;
        }
    }
}

Commit configuration, and then check the route in R1 routing instance

root@Olive# run show route table vpn-a.inet.0 logical-system r1  

vpn-a.inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

4.4.4.4/32         *[BGP/170] 00:05:53, MED 1, localpref 100, from 2.2.2.2
                      AS path: I
                    > to 192.168.12.2 via em1.12, Push 16
6.6.6.6/32         *[Static/5] 00:06:57
                    > to 192.168.16.6 via em1.16
7.7.7.7/32         *[Static/5] 00:06:57
                    > to 192.168.17.7 via em1.17
192.168.16.0/24    *[Direct/0] 00:06:57
                    > via em1.16
192.168.16.1/32    *[Local/0] 00:06:57
                      Local via em1.16
192.168.17.0/24    *[Direct/0] 00:06:57
                    > via em1.17
192.168.17.1/32    *[Local/0] 00:06:57
                      Local via em1.17
192.168.24.0/24    *[BGP/170] 00:05:52, localpref 100, from 2.2.2.2
                      AS path: I
                    > to 192.168.12.2 via em1.12, Push 16

root@Olive# run show route table vpn-ab.inet.0 logical-system r1  

vpn-ab.inet.0: 13 destinations, 13 routes (13 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

4.4.4.4/32         *[BGP/170] 00:06:13, MED 1, localpref 100, from 2.2.2.2
                      AS path: I
                    > to 192.168.12.2 via em1.12, Push 16
5.5.5.5/32         *[BGP/170] 00:06:12, MED 1, localpref 100, from 3.3.3.3
                      AS path: I
                    > to 192.168.13.3 via em1.13, Push 16
6.6.6.6/32         *[Static/5] 00:07:17
                    > to 192.168.16.6 via em1.16
7.7.7.7/32         *[Static/5] 00:07:17
                    > to 192.168.17.7 via em1.17
8.8.8.8/32         *[Static/5] 00:07:17
                    > to 192.168.18.8 via em1.18
192.168.16.0/24    *[Direct/0] 00:07:17
                    > via em1.16
192.168.16.1/32    *[Local/0] 00:07:17
                      Local via em1.16
192.168.17.0/24    *[Direct/0] 00:07:17
                    > via em1.17
192.168.17.1/32    *[Local/0] 00:07:17
                      Local via em1.17
192.168.18.0/24    *[Direct/0] 00:07:17
                    > via em1.18
192.168.18.1/32    *[Local/0] 00:07:17
                      Local via em1.18
192.168.24.0/24    *[BGP/170] 00:06:12, localpref 100, from 2.2.2.2
                      AS path: I
                    > to 192.168.12.2 via em1.12, Push 16
192.168.35.0/24    *[BGP/170] 00:06:12, localpref 100, from 3.3.3.3
                      AS path: I
                    > to 192.168.13.3 via em1.13, Push 16

root@Olive# run show route table vpn-b.inet.0 logical-system r1    

vpn-b.inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

5.5.5.5/32         *[BGP/170] 00:06:23, MED 1, localpref 100, from 3.3.3.3
                      AS path: I
                    > to 192.168.13.3 via em1.13, Push 16
7.7.7.7/32         *[Static/5] 00:07:28
                    > to 192.168.17.7 via em1.17
8.8.8.8/32         *[Static/5] 00:07:28
                    > to 192.168.18.8 via em1.18
192.168.17.0/24    *[Direct/0] 00:07:28
                    > via em1.17
192.168.17.1/32    *[Local/0] 00:07:28
                      Local via em1.17
192.168.18.0/24    *[Direct/0] 00:07:28
                    > via em1.18
192.168.18.1/32    *[Local/0] 00:07:28
                      Local via em1.18
192.168.35.0/24    *[BGP/170] 00:06:23, localpref 100, from 3.3.3.3
                      AS path: I
                    > to 192.168.13.3 via em1.13, Push 16

From above results, vpn-a and vpn-b has learnd the routing of 7.7.7.7/32, and vpn-ab also has learn the routing item of 6.6.6.6/32 of vpn-a and 8.8.8.8/32 of vpn-b.
In the same way, the instance of r2 and r3 can learn the 7.7.7.7/32 routing items that was belong to
instance vpn-ab.

root@Olive# run show route table vpn-a.inet.0 logical-system r2       

vpn-a.inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

4.4.4.4/32         *[OSPF/10] 00:09:51, metric 1
                    > to 192.168.24.4 via em2.24
6.6.6.6/32         *[BGP/170] 00:09:32, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.12.1 via em2.12, Push 16
7.7.7.7/32         *[BGP/170] 00:09:31, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.12.1 via em2.12, Push 17
192.168.16.0/24    *[BGP/170] 00:09:32, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.12.1 via em2.12, Push 16
192.168.17.0/24    *[BGP/170] 00:09:31, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.12.1 via em2.12, Push 17
192.168.24.0/24    *[Direct/0] 00:10:36
                    > via em2.24
192.168.24.2/32    *[Local/0] 00:10:36
                      Local via em2.24
224.0.0.5/32       *[OSPF/10] 00:10:44, metric 1
                      MultiRecv

root@Olive# run show route table vpn-b.inet.0 logical-system r3      

vpn-b.inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

5.5.5.5/32         *[OSPF/10] 00:11:27, metric 1
                    > to 192.168.35.5 via em2.35
7.7.7.7/32         *[BGP/170] 00:11:07, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.13.1 via em2.13, Push 17
8.8.8.8/32         *[BGP/170] 00:11:07, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.13.1 via em2.13, Push 18
192.168.17.0/24    *[BGP/170] 00:11:07, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.13.1 via em2.13, Push 17
192.168.18.0/24    *[BGP/170] 00:11:07, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.13.1 via em2.13, Push 18
192.168.35.0/24    *[Direct/0] 00:12:12
                    > via em2.35
192.168.35.3/32    *[Local/0] 00:12:12
                      Local via em2.35
224.0.0.5/32       *[OSPF/10] 00:12:20, metric 1
                      MultiRecv

The CE customer of r2 also can learn the routing of vpn-ab. Because it’s OSPF external route, so it
has the tag.

root@Olive# run show route protocol ospf logical-system r4

inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

6.6.6.6/32         *[OSPF/150] 00:12:06, metric 0, tag 3489661028
                    > to 192.168.24.2 via em1.24
7.7.7.7/32         *[OSPF/150] 00:12:06, metric 0, tag 3489661028
                    > to 192.168.24.2 via em1.24
192.168.16.0/24    *[OSPF/150] 00:12:06, metric 0, tag 3489661028
                    > to 192.168.24.2 via em1.24
192.168.17.0/24    *[OSPF/150] 00:12:06, metric 0, tag 3489661028
                    > to 192.168.24.2 via em1.24
224.0.0.5/32       *[OSPF/10] 00:13:23, metric 1
                      MultiRecv

root@Olive# run show route protocol ospf logical-system r5

inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

7.7.7.7/32         *[OSPF/150] 00:12:48, metric 0, tag 3489661028
                    > to 192.168.35.3 via em1.35
8.8.8.8/32         *[OSPF/150] 00:12:48, metric 0, tag 3489661028
                    > to 192.168.35.3 via em1.35
192.168.17.0/24    *[OSPF/150] 00:12:48, metric 0, tag 3489661028
                    > to 192.168.35.3 via em1.35
192.168.18.0/24    *[OSPF/150] 00:12:48, metric 0, tag 3489661028
                    > to 192.168.35.3 via em1.35
224.0.0.5/32       *[OSPF/10] 00:14:06, metric 1
                      MultiRecv

Check R2 label and next-hop to 7.7.7.7/32

root@Olive# run show route 7.7.7.7/32 logical-system r2 detail | match "label|Protocol next hop"
                Label operation: Push 17
                Label TTL action: prop-ttl
                Protocol next hop: 1.1.1.1
                VPN Label: 17
                Label operation: Push 17
                Label TTL action: prop-ttl
                Protocol next hop: 1.1.1.1
                VPN Label: 17

From above, can see that r2 forward label l7 to next hop r1 directly as r2 and r1 is connected
directly. There is just one VPN label here and the out-lable was poped as its destination is 1.1.1.1.
R1 will pop the label and forward into vpn-ab.inet.0 once it received VPN label

root@Olive# run show route label 17 logical-system r1 

mpls.0: 10 destinations, 10 routes (10 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

17                 *[VPN/0] 00:17:26
                      to table vpn-ab.inet.0, Pop

So R4 and R5 can reach to 7.7.7.7

root@Olive# run ping 7.7.7.7 logical-system r4 source 4.4.4.4 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.031/5.524/15.461/5.169 ms

root@Olive# run ping 7.7.7.7 logical-system r5 source 5.5.5.5 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.598/3.563/4.043/0.502 ms

So R6 and R8 can reach to 7.7.7.7

root@Olive# run ping 7.7.7.7 logical-system r6 source 6.6.6.6 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.872/2.576/3.148/0.468 ms

root@Olive# run ping 7.7.7.7 logical-system r8 source 8.8.8.8 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.459/2.442/3.564/0.706 ms

Next test the BGP protocol between PE-CE. As the following, The static key wards of the policy that
defined before should be replaced by bgp.

root@Olive# show r1 policy-options
policy-statement vpn-a-export {
    term 1 {
        from {
            protocol [ static direct ];
            interface em1.16;
        }
        then {
            community add vpn-a;
            accept;
        }
    }
    term 2 {
        then reject;
    }
}
policy-statement vpn-a-import {
    term 1 {
        from {
            protocol bgp;
            community vpn-a;
        }
        then accept;
    }
    term 2 {
        then reject;
    }
}
policy-statement vpn-ab-export {
    term 1 {
        from {
            protocol [ static direct ];
            interface em1.17;
        }
        then {
            community add vpn-a;
            community add vpn-b;
            accept;
        }
    }
    term 2 {
        then reject;
    }
}
policy-statement vpn-ab-import {
    term 1 {
        from {
            protocol bgp;              
            community [ vpn-a vpn-b ];
        }
        then accept;
    }
    term 2 {
        then reject;
    }
}
policy-statement vpn-b-export {
    term 1 {
        from {
            protocol [ static direct ];
            interface em1.18;
        }
        then {
            community add vpn-b;
            accept;
        }
    }
    term 2 {
        then reject;
    }
}
policy-statement vpn-b-import {
    term 1 {
        from {
            protocol bgp;
            community vpn-b;
        }
        then accept;
    }
    term 2 {
        then reject;
    }
}
community vpn-a members target:100:1;
community vpn-b members target:100:2;

Meanwhile, the default routing configured before should be deleted too. Then configure BGP routing
protocol, redistribute routes into BGP.

root@Olive# show r6 protocols bgp
group ebgp {
    type external;
    export to-ebgp;
    neighbor 192.168.16.1 {
        peer-as 100;
    }
}

root@Olive# show r7 protocols bgp   
group ebgp {
    type external;
    export to-ebgp;
    neighbor 192.168.17.1 {
        peer-as 100;
    }
}

root@Olive# show r8 protocols bgp   
group ebgp {
    type external;
    export to-ebgp;
    neighbor 192.168.18.1 {
        peer-as 100;
    }
}

Change R1 routing-instance protocol to BGP

root@Olive# show r1 routing-instances
vpn-a {
    instance-type vrf;
    interface em1.16;
    route-distinguisher 100:1;
    vrf-import vpn-a-import;
    vrf-export vpn-a-export;
    vrf-table-label;
    protocols {
        bgp {
            group ebgp-r6 {
                type external;
                family inet {
                    unicast {
                        rib-group vpn-a-ab;
                    }
                }
                neighbor 192.168.16.6 {
                    peer-as 600;
                }
            }
        }
    }
}
vpn-ab {
    instance-type vrf;
    interface em1.17;
    route-distinguisher 100:3;
    vrf-import vpn-ab-import;
    vrf-export vpn-ab-export;
    vrf-table-label;
    protocols {
        bgp {
            group ebgp-r7 {
                type external;
                family inet {
                    unicast {
                        rib-group vpn-a-b-ab;
                    }
                }
                neighbor 192.168.17.7 {
                    peer-as 700;
                }
            }
        }
    }
}
vpn-b {                                
    instance-type vrf;
    interface em1.18;
    route-distinguisher 100:2;
    vrf-import vpn-b-import;
    vrf-export vpn-b-export;
    vrf-table-label;
    protocols {
        bgp {
            group ebgp-r8 {
                type external;
                family inet {
                    unicast {
                        rib-group vpn-b-ab;
                    }
                }
                neighbor 192.168.18.8 {
                    peer-as 800;
                }
            }
        }
    }
}

Commit configuration and then ping 7.7.7.7 in CE R4

root@Olive# run ping 7.7.7.7 logical-system r4 source 4.4.4.4 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.417/5.784/19.674/7.045 ms

root@Olive# run ping 7.7.7.7 logical-system r6 source 6.6.6.6 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.439/1.820/2.330/0.340 ms

root@Olive# run ping 7.7.7.7 logical-system r5 source 5.5.5.5 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.256/1.506/1.734/0.157 ms

root@Olive# run ping 7.7.7.7 logical-system r8 source 8.8.8.8 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.562/2.183/2.874/0.452 ms

Below is the limit when use the routing table group.
Complicated configuration. There should define one routing table group for per routing-instance in order to import route conveniently. (In above simulation, there defined a rib-group for per instance )
There should define one routing table group for per protocol in order to import routing. (In above simulation, there configured rib-group under static and BGP in routing instance.)
In order to breakthrough above limit, the JUNOS routing auto-export feature can be used.
It will check the exsitent policy and determine which routing table will import or export routing.
And import or export routing according to the specified value of RT community.
There is no need to define rib-groups after enable auto export. So the rib-groups should be deleted on r1 and delete the rib-group under the routing-instance protocol as well.

root@Olive# show r1 routing-options            
rib-groups {
    vpn-a-ab {
        import-rib [ vpn-a.inet.0 vpn-ab.inet.0 ];
    }
    vpn-b-ab {
        import-rib [ vpn-b.inet.0 vpn-ab.inet.0 ];
    }
    vpn-a-b-ab {
        import-rib [ vpn-ab.inet.0 vpn-a.inet.0 vpn-b.inet.0 ];
    }
}

root@Olive# delete r1 routing-options rib-groups
Next just enable auto-export under instance, and there is just need the basic configuration under protocols.

root@Olive# show r1 routing-instances
vpn-a {
    instance-type vrf;
    interface em1.16;
    route-distinguisher 100:1;
    vrf-import vpn-a-import;
    vrf-export vpn-a-export;
    vrf-table-label;
    routing-options {
        auto-export;
    }
    protocols {
        bgp {
            group ebgp-r6 {
                type external;
                neighbor 192.168.16.6 {
                    peer-as 600;
                }
            }
        }
    }
}
vpn-ab {
    instance-type vrf;
    interface em1.17;
    route-distinguisher 100:3;
    vrf-import vpn-ab-import;
    vrf-export vpn-ab-export;
    vrf-table-label;
    routing-options {
        auto-export;
    }
    protocols {
        bgp {
            group ebgp-r7 {
                type external;
                neighbor 192.168.17.7 {
                    peer-as 700;
                }
            }
        }
    }
}
vpn-b {
    instance-type vrf;
    interface em1.18;
    route-distinguisher 100:2;
    vrf-import vpn-b-import;          
    vrf-export vpn-b-export;
    vrf-table-label;
    routing-options {
        auto-export;
    }
    protocols {
        bgp {
            group ebgp-r8 {
                type external;
                neighbor 192.168.18.8 {
                    peer-as 800;
                }
            }
        }
    }
}

After running that configuration, the route will be exchange in each instance. So CE of vpn-a and vpn-b will learn the routing item 7.7.7.7/32 in vpn-ab.

root@Olive# run show route protocol bgp logical-system r6   

inet.0: 6 destinations, 6 routes (6 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

4.4.4.4/32         *[BGP/170] 00:00:20, localpref 100
                      AS path: 100 I
                    > to 192.168.16.1 via em2.16
7.7.7.7/32         *[BGP/170] 00:00:57, localpref 100
                      AS path: 100 700 I
                    > to 192.168.16.1 via em2.16
192.168.24.0/24    *[BGP/170] 00:00:20, localpref 100
                      AS path: 100 I
                    > to 192.168.16.1 via em2.16

root@Olive# run show route protocol bgp logical-system r8   

inet.0: 6 destinations, 6 routes (6 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

5.5.5.5/32         *[BGP/170] 00:00:24, localpref 100
                      AS path: 100 I
                    > to 192.168.18.1 via em2.18
7.7.7.7/32         *[BGP/170] 00:01:05, localpref 100
                      AS path: 100 700 I
                    > to 192.168.18.1 via em2.18
192.168.35.0/24    *[BGP/170] 00:00:24, localpref 100
                      AS path: 100 I
                    > to 192.168.18.1 via em2.18

root@Olive# run ping 7.7.7.7 logical-system r4 source 4.4.4.4 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.265/4.622/8.157/1.996 ms

root@Olive# run ping 7.7.7.7 logical-system r5 source 5.5.5.5 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.424/3.051/3.609/0.492 ms

root@Olive# run ping 7.7.7.7 logical-system r6 source 6.6.6.6 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.390/1.667/2.008/0.253 ms

root@Olive# run ping 7.7.7.7 logical-system r8 source 8.8.8.8 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.252/3.330/7.172/2.064 ms

auto-export also can be configured for all the VRF instance, in this way all the auto-export
command under routing-instance could be deleted

[edit logical-systems r1 routing-instances]
root@Olive# delete vpn-a routing-options auto-export

[edit logical-systems r1 routing-instances]
root@Olive# delete vpn-ab routing-options auto-export

[edit logical-systems r1 routing-instances]
root@Olive# delete vpn-b routing-options auto-export

[edit]
root@Olive# show groups
vrf-export-all {
    logical-systems {
        <*> {
            routing-instances {
                <*> {
                    routing-options {
                        auto-export;
                    }
                }
            }
        }
    }
}

[edit]
root@Olive# set apply-groups vrf-export-all

root@Olive# run show configuration logical-systems r1 routing-instances | display inheritance   
vpn-a {
    instance-type vrf;
    interface em1.16;
    route-distinguisher 100:1;
    vrf-import vpn-a-import;
    vrf-export vpn-a-export;
    vrf-table-label;
    ##
    ## 'routing-options' was inherited from group 'vrf-export-all'
    ##
    routing-options {
        ##
        ## 'auto-export' was inherited from group 'vrf-export-all'
        ##
        auto-export;
    }
    protocols {
        bgp {
            group ebgp-r6 {
                type external;
                neighbor 192.168.16.6 {
                    peer-as 600;
                }
            }
        }
    }
}
vpn-ab {
    instance-type vrf;
    interface em1.17;
    route-distinguisher 100:3;
    vrf-import vpn-ab-import;
    vrf-export vpn-ab-export;
    vrf-table-label;
    ##
    ## 'routing-options' was inherited from group 'vrf-export-all'
    ##
    routing-options {
        ##
        ## 'auto-export' was inherited from group 'vrf-export-all'
        ##
        auto-export;
    }
    protocols {
        bgp {
            group ebgp-r7 {
                type external;         
                neighbor 192.168.17.7 {
                    peer-as 700;
                }
            }
        }
    }
}
vpn-b {
    instance-type vrf;
    interface em1.18;
    route-distinguisher 100:2;
    vrf-import vpn-b-import;
    vrf-export vpn-b-export;
    vrf-table-label;
    ##
    ## 'routing-options' was inherited from group 'vrf-export-all'
    ##
    routing-options {
        ##
        ## 'auto-export' was inherited from group 'vrf-export-all'
        ##
        auto-export;
    }
    protocols {
        bgp {
            group ebgp-r8 {
                type external;
                neighbor 192.168.18.8 {
                    peer-as 800;
                }
            }
        }
    }
}