Juniper BGP Route Reflector MPLS/VPN

BGP Route Reflector MPLS/VPN

The IBGP neighbor is configured among the 3 PE's and RR. The cluster-id of RR is 1.1.1.1.
There are two path from R3 to 7.7.7.7/32, and R3 chooses the path via R2 to the next hop R6, and R6 chooses RR to the next hop of R3 VPN route.
Why not all the path via RR ? The reason is that RR just advertise VPNv4 route to PE.
When PE received the VPN route from VPN RR, it will check the next-hop of PE lo0 interface address in inet.3 route table. If using LDP for MPLS signal, the path of inet.3 route item will depend on inet.0 route table, it means if IGP path use R3-R2-R6，VPNv4 path will use the same IGP path. In this case R3 to R6 will across R1 or R2 in random.
In order to know the result more clearly, check the path from R2 to 7.7.7.7/32.

root@Olive# run show route 7.7.7.7/32 logical-system r2 detail 

< output omitted >

bgp.l3vpn.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden)

100:1:7.7.7.7/32 (1 entry, 0 announced)
        *BGP    Preference: 170/-101
                Route Distinguisher: 100:1
                Next hop type: Indirect
                Next-hop reference count: 6
                Source: 1.1.1.1
                Next hop type: Router, Next hop index: 1075
                Next hop: 192.168.26.6 via em1.26, selected
                Label operation: Push 16
                Label TTL action: prop-ttl
                Protocol next hop: 6.6.6.6
                Push 16
                Indirect next hop: 8f845a0 131075
                State:
                Local AS:   100 Peer AS:   100
                Age: 4:04       Metric2: 1
                Task: BGP_100.1.1.1.1+179
                AS path: 700 I (Originator) Cluster list:  1.1.1.1
                AS path:  Originator ID: 6.6.6.6
                Communities: target:100:1
                Import Accepted
                VPN Label: 16
                Localpref: 100
                Router ID: 1.1.1.1
                Secondary Tables: vpn-a.inet.0

The traffic not always via RR, but to the next-hop PE of VPN route by the IGP shortest path, and the next-hop is not RR as well. R2 transfer traffic to R6 directly, check the label on R6.

root@Olive# run show route label 16 logical-system r6

mpls.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

16                 *[VPN/0] 00:12:42
                      to table vpn-a.inet.0, Pop

The function of RR is just advertise the VPNv4 routing to all PE's belong to this cluster, and will not change the next-hop (Because there is no any VPN customer on RR, and it can’t generate VPN label,
and can’t work as VPNv4 next-hop as well).
Check the BPG neighbor summary information on R2, there is no IBGP neighbor relationship between R2 and R6.
It means that the routing control plane is transferred by RR, but R2 not learn from R6 in directly. While in forwarding plane, it will not via RR, and transferred to R6 directly.

root@Olive# run show bgp summary logical-system r2
Groups: 2 Peers: 2 Down peers: 0
Table          Tot Paths  Act Paths Suppressed    History Damp State    Pending
bgp.l3vpn.0            4          4          0          0          0          0
Peer                     AS      InPkt     OutPkt    OutQ   Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
1.1.1.1                 100         42         42       0       0       16:56 Establ
  bgp.l3vpn.0: 4/4/4/0
  vpn-a.inet.0: 4/4/4/0
192.168.24.4            400         44         47       0       0       18:07 Establ
  vpn-a.inet.0: 1/2/2/0

The reachable between CE's

root@Olive# run ping 7.7.7.7 logical-system r4 source 4.4.4.4 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.792/1.219/2.385/0.593 ms

root@Olive# run ping 5.5.5.5 logical-system r4 source 4.4.4.4 rapid
PING 5.5.5.5 (5.5.5.5): 56 data bytes
!!!!!
--- 5.5.5.5 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.502/3.315/4.997/1.165 ms

Juniper LDP over RSVP Tunnel MPLS/VPN

LDP over RSVP Tunnel MPLS

Create RSVP LSP between R6 and r7, make sure the LDP signal can across the RSVP LSP

root@Olive# show r6 protocols                       

rsvp {

    interface em2.16;

}

mpls {

    label-switched-path r6-r7 {

        to 7.7.7.7;

        ldp-tunneling;

    }

    interface em2.16;

    interface em2.26;

}

ospf {

    traffic-engineering;

    area 0.0.0.0 {

        interface all;

        interface lo0.6 {

            passive;

        }

    }

}

ldp {

    interface em2.26;

    interface lo0.6;

}

root@Olive# show r7 protocols    

rsvp {

    interface em2.17;

}

mpls {

    label-switched-path r7-r6 {

        to 6.6.6.6;

        ldp-tunneling;

    }

    interface em2.17;

    interface em2.37;

}

ospf {

    traffic-engineering;

    area 0.0.0.0 {

        interface all;

        interface lo0.7 {

            passive;

        }

    }

}

ldp {

    interface em2.37;

    interface lo0.7;

}

Enable OSPF TE on r1

root@Olive# run show mpls lsp logical-system r6   
Ingress LSP: 1 sessions
To              From            State Rt P     ActivePath       LSPname
7.7.7.7         6.6.6.6         Up     0 *                      r6-r7
Total 1 displayed, Up 1, Down 0

Egress LSP: 1 sessions
To              From            State   Rt Style Labelin Labelout LSPname
6.6.6.6         7.7.7.7         Up       0  1 FF       3        - r7-r6
Total 1 displayed, Up 1, Down 0

Transit LSP: 0 sessions
Total 0 displayed, Up 0, Down 0

CE Routing Table

root@Olive# run show route protocol ospf logical-system r4

inet.0: 6 destinations, 6 routes (6 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

5.5.5.5/32         *[OSPF/10] 00:23:51, metric 2
                    > to 192.168.24.2 via em2.24
192.168.35.0/24    *[OSPF/150] 00:23:51, metric 0, tag 3489661028
                    > to 192.168.24.2 via em2.24
224.0.0.5/32       *[OSPF/10] 00:25:33, metric 1
                      MultiRecv

root@Olive# run ping 5.5.5.5 logical-system r4 source 4.4.4.4 rapid
PING 5.5.5.5 (5.5.5.5): 56 data bytes
!!!!!
--- 5.5.5.5 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.000/2.671/4.021/0.845 ms

Check label from R2 To 5.5.5.5

root@Olive# run show route table vpn-a.inet.0 5.5.5.5/32 logical-system r2 detail | match "Label|Protocol next hop" 
                Label operation: Push 16, Push 299808(top)
                Label TTL action: prop-ttl, prop-ttl(top)
                Protocol next hop: 3.3.3.3
                VPN Label: 16

root@Olive# run show route table inet.3 3.3.3.3/32 logical-system r2 detail

inet.3: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
3.3.3.3/32 (1 entry, 1 announced)
        State:
        *LDP    Preference: 9
                Next hop type: Router
                Next-hop reference count: 2
                Next hop: 192.168.26.6 via em1.26, selected
                Label operation: Push 299808
                Label TTL action: prop-ttl
                State:
                Local AS:   100
                Age: 27:19      Metric: 1
                Task: LDP
                Announcement bits (1): 2-Resolve tree 1
                AS path: I

The label 16 is VPN label which is generate by R3, and the outside lebel is 299808 that is generated
by R6.
Check the label 299808 on R6.

root@Olive# run show route label 299808 logical-system r6 detail

mpls.0: 7 destinations, 7 routes (7 active, 0 holddown, 0 hidden)
299808 (1 entry, 1 announced)
        *LDP    Preference: 9
                Next hop type: Router, Next hop index: 1033
                Next-hop reference count: 2
                Next hop: 192.168.16.1 via em2.16 weight 0x1, selected
                Label-switched-path r6-r7
                Label operation: Swap 299776, Push 299792(top)
                Label TTL action: prop-ttl, prop-ttl(top)
                State:
                Age: 30:51      Metric: 1
                Task: LDP
                Announcement bits (1): 1-KRT
                AS path: I
                Prefixes bound to route: 3.3.3.3/32

R6 swap the label into 299776, and this swap label is distributed by R7 RSVP LSP.
And R6 will distribute outside label 299776 for r7, and this one is distributed by R1.
root@Olive# run show route label 299776 logical-system r1 detail     

mpls.0: 7 destinations, 7 routes (7 active, 0 holddown, 0 hidden)
299776 (1 entry, 1 announced)
        *RSVP   Preference: 7/1
                Next hop type: Router, Next hop index: 1027
                Next-hop reference count: 3
                Next hop: 192.168.16.6 via em1.16 weight 0x1, selected
                Label-switched-path r7-r6
                Label operation: Pop     
                State:
                Local AS:   100
                Age: 33:20      Metric: 1
                Task: RSVP
                Announcement bits (1): 1-KRT
                AS path: I

R1 will pop the label 299776 once it receive it. Then forward the label 299776 to R7.

root@Olive# run show route label 299776 logical-system r1 detail     

mpls.0: 7 destinations, 7 routes (7 active, 0 holddown, 0 hidden)
299776 (1 entry, 1 announced)
        *RSVP   Preference: 7/1
                Next hop type: Router, Next hop index: 1027
                Next-hop reference count: 3
                Next hop: 192.168.16.6 via em1.16 weight 0x1, selected
                Label-switched-path r7-r6
                Label operation: Pop     
                State:
                Local AS:   100
                Age: 38:29      Metric: 1
                Task: RSVP
                Announcement bits (1): 1-KRT
                AS path: I

R1 will pop the label 299776 once it receive it. Then forward the label 299776 to R7.
root@Olive# run show route label 299776 logical-system r7 detail     

mpls.0: 7 destinations, 7 routes (7 active, 0 holddown, 0 hidden)
299776 (1 entry, 1 announced)
        *LDP    Preference: 9
                Next hop type: Router, Next hop index: 1023
                Next-hop reference count: 2
                Next hop: 192.168.37.3 via em2.37, selected
                Label operation: Pop     
                State:
                Age: 39:14      Metric: 1
                Task: LDP
                Announcement bits (1): 1-KRT
                AS path: I
                Prefixes bound to route: 3.3.3.3/32

R7 will pop the label 299776 once it receive, and then forward the only one layer VPN label l6 to R3.

root@Olive# run show route label 16 logical-system r3

mpls.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

16                 *[VPN/0] 00:45:55
                      to table vpn-a.inet.0, Pop

Juniper Overlay MPLS VPN

Overlay MPLS VPN

Just as vpn-a, vpn-b, vpn-ab, instance_name.inet.0 means routing-instance routing table.
The different instance routing table need to learn routing of each others,
Therefore routing import must among there, and this could be realize by configure routing table group.
As the following, vpn-a.inet.0 and vpn-b.inet.0 routing table was imported into vpn-ab.inet.0

root@Olive# show r1 routing-options
rib-groups {
    vpn-a-ab {
        import-rib [ vpn-a.inet.0 vpn-ab.inet.0 ];
    }
    vpn-b-ab {
        import-rib [ vpn-b.inet.0 vpn-ab.inet.0 ];
    }
    vpn-a-b-ab {
        import-rib [ vpn-ab.inet.0 vpn-a.inet.0 vpn-b.inet.0 ];
    }
}
autonomous-system 100;

Next apply different rib-group to related routing-instance, here's the static route is used as the routing
between PE-CE. Different with general, although in this simulation have applyed rib-groups for import the routes from another instance, but need to create static route to another instance.

root@Olive# show r1 routing-instances
vpn-a {
    instance-type vrf;
    interface em1.16;
    route-distinguisher 100:1;
    vrf-import vpn-a-import;
    vrf-export vpn-a-export;
    vrf-table-label;
    routing-options {
        interface-routes {
            rib-group inet vpn-a-ab;
        }
        static {
            route 6.6.6.6/32 next-hop 192.168.16.6;
            route 7.7.7.7/32 next-hop 192.168.17.7;
        }
    }
}
vpn-ab {
    instance-type vrf;
    interface em1.17;
    route-distinguisher 100:3;
    vrf-import vpn-ab-import;
    vrf-export vpn-ab-export;
    vrf-table-label;
    routing-options {
        interface-routes {
            rib-group inet vpn-a-b-ab;
        }
        static {
            route 6.6.6.6/32 next-hop 192.168.16.6;
            route 7.7.7.7/32 next-hop 192.168.17.7;
            route 8.8.8.8/32 next-hop 192.168.18.8;
        }
    }
}
vpn-b {
    instance-type vrf;
    interface em1.18;
    route-distinguisher 100:2;
    vrf-import vpn-b-import;
    vrf-export vpn-b-export;
    vrf-table-label;
    routing-options {
        interface-routes {
            rib-group inet vpn-b-ab;
        }
        static {                       
            route 7.7.7.7/32 next-hop 192.168.17.7;
            route 8.8.8.8/32 next-hop 192.168.18.8;
        }
    }
}

Commit configuration, and then check the route in R1 routing instance

root@Olive# run show route table vpn-a.inet.0 logical-system r1  

vpn-a.inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

4.4.4.4/32         *[BGP/170] 00:05:53, MED 1, localpref 100, from 2.2.2.2
                      AS path: I
                    > to 192.168.12.2 via em1.12, Push 16
6.6.6.6/32         *[Static/5] 00:06:57
                    > to 192.168.16.6 via em1.16
7.7.7.7/32         *[Static/5] 00:06:57
                    > to 192.168.17.7 via em1.17
192.168.16.0/24    *[Direct/0] 00:06:57
                    > via em1.16
192.168.16.1/32    *[Local/0] 00:06:57
                      Local via em1.16
192.168.17.0/24    *[Direct/0] 00:06:57
                    > via em1.17
192.168.17.1/32    *[Local/0] 00:06:57
                      Local via em1.17
192.168.24.0/24    *[BGP/170] 00:05:52, localpref 100, from 2.2.2.2
                      AS path: I
                    > to 192.168.12.2 via em1.12, Push 16

root@Olive# run show route table vpn-ab.inet.0 logical-system r1  

vpn-ab.inet.0: 13 destinations, 13 routes (13 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

4.4.4.4/32         *[BGP/170] 00:06:13, MED 1, localpref 100, from 2.2.2.2
                      AS path: I
                    > to 192.168.12.2 via em1.12, Push 16
5.5.5.5/32         *[BGP/170] 00:06:12, MED 1, localpref 100, from 3.3.3.3
                      AS path: I
                    > to 192.168.13.3 via em1.13, Push 16
6.6.6.6/32         *[Static/5] 00:07:17
                    > to 192.168.16.6 via em1.16
7.7.7.7/32         *[Static/5] 00:07:17
                    > to 192.168.17.7 via em1.17
8.8.8.8/32         *[Static/5] 00:07:17
                    > to 192.168.18.8 via em1.18
192.168.16.0/24    *[Direct/0] 00:07:17
                    > via em1.16
192.168.16.1/32    *[Local/0] 00:07:17
                      Local via em1.16
192.168.17.0/24    *[Direct/0] 00:07:17
                    > via em1.17
192.168.17.1/32    *[Local/0] 00:07:17
                      Local via em1.17
192.168.18.0/24    *[Direct/0] 00:07:17
                    > via em1.18
192.168.18.1/32    *[Local/0] 00:07:17
                      Local via em1.18
192.168.24.0/24    *[BGP/170] 00:06:12, localpref 100, from 2.2.2.2
                      AS path: I
                    > to 192.168.12.2 via em1.12, Push 16
192.168.35.0/24    *[BGP/170] 00:06:12, localpref 100, from 3.3.3.3
                      AS path: I
                    > to 192.168.13.3 via em1.13, Push 16

root@Olive# run show route table vpn-b.inet.0 logical-system r1    

vpn-b.inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

5.5.5.5/32         *[BGP/170] 00:06:23, MED 1, localpref 100, from 3.3.3.3
                      AS path: I
                    > to 192.168.13.3 via em1.13, Push 16
7.7.7.7/32         *[Static/5] 00:07:28
                    > to 192.168.17.7 via em1.17
8.8.8.8/32         *[Static/5] 00:07:28
                    > to 192.168.18.8 via em1.18
192.168.17.0/24    *[Direct/0] 00:07:28
                    > via em1.17
192.168.17.1/32    *[Local/0] 00:07:28
                      Local via em1.17
192.168.18.0/24    *[Direct/0] 00:07:28
                    > via em1.18
192.168.18.1/32    *[Local/0] 00:07:28
                      Local via em1.18
192.168.35.0/24    *[BGP/170] 00:06:23, localpref 100, from 3.3.3.3
                      AS path: I
                    > to 192.168.13.3 via em1.13, Push 16

From above results, vpn-a and vpn-b has learnd the routing of 7.7.7.7/32, and vpn-ab also has learn the routing item of 6.6.6.6/32 of vpn-a and 8.8.8.8/32 of vpn-b.
In the same way, the instance of r2 and r3 can learn the 7.7.7.7/32 routing items that was belong to
instance vpn-ab.

root@Olive# run show route table vpn-a.inet.0 logical-system r2       

vpn-a.inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

4.4.4.4/32         *[OSPF/10] 00:09:51, metric 1
                    > to 192.168.24.4 via em2.24
6.6.6.6/32         *[BGP/170] 00:09:32, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.12.1 via em2.12, Push 16
7.7.7.7/32         *[BGP/170] 00:09:31, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.12.1 via em2.12, Push 17
192.168.16.0/24    *[BGP/170] 00:09:32, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.12.1 via em2.12, Push 16
192.168.17.0/24    *[BGP/170] 00:09:31, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.12.1 via em2.12, Push 17
192.168.24.0/24    *[Direct/0] 00:10:36
                    > via em2.24
192.168.24.2/32    *[Local/0] 00:10:36
                      Local via em2.24
224.0.0.5/32       *[OSPF/10] 00:10:44, metric 1
                      MultiRecv

root@Olive# run show route table vpn-b.inet.0 logical-system r3      

vpn-b.inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

5.5.5.5/32         *[OSPF/10] 00:11:27, metric 1
                    > to 192.168.35.5 via em2.35
7.7.7.7/32         *[BGP/170] 00:11:07, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.13.1 via em2.13, Push 17
8.8.8.8/32         *[BGP/170] 00:11:07, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.13.1 via em2.13, Push 18
192.168.17.0/24    *[BGP/170] 00:11:07, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.13.1 via em2.13, Push 17
192.168.18.0/24    *[BGP/170] 00:11:07, localpref 100, from 1.1.1.1
                      AS path: I
                    > to 192.168.13.1 via em2.13, Push 18
192.168.35.0/24    *[Direct/0] 00:12:12
                    > via em2.35
192.168.35.3/32    *[Local/0] 00:12:12
                      Local via em2.35
224.0.0.5/32       *[OSPF/10] 00:12:20, metric 1
                      MultiRecv

The CE customer of r2 also can learn the routing of vpn-ab. Because it’s OSPF external route, so it
has the tag.

root@Olive# run show route protocol ospf logical-system r4

inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

6.6.6.6/32         *[OSPF/150] 00:12:06, metric 0, tag 3489661028
                    > to 192.168.24.2 via em1.24
7.7.7.7/32         *[OSPF/150] 00:12:06, metric 0, tag 3489661028
                    > to 192.168.24.2 via em1.24
192.168.16.0/24    *[OSPF/150] 00:12:06, metric 0, tag 3489661028
                    > to 192.168.24.2 via em1.24
192.168.17.0/24    *[OSPF/150] 00:12:06, metric 0, tag 3489661028
                    > to 192.168.24.2 via em1.24
224.0.0.5/32       *[OSPF/10] 00:13:23, metric 1
                      MultiRecv

root@Olive# run show route protocol ospf logical-system r5

inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

7.7.7.7/32         *[OSPF/150] 00:12:48, metric 0, tag 3489661028
                    > to 192.168.35.3 via em1.35
8.8.8.8/32         *[OSPF/150] 00:12:48, metric 0, tag 3489661028
                    > to 192.168.35.3 via em1.35
192.168.17.0/24    *[OSPF/150] 00:12:48, metric 0, tag 3489661028
                    > to 192.168.35.3 via em1.35
192.168.18.0/24    *[OSPF/150] 00:12:48, metric 0, tag 3489661028
                    > to 192.168.35.3 via em1.35
224.0.0.5/32       *[OSPF/10] 00:14:06, metric 1
                      MultiRecv

Check R2 label and next-hop to 7.7.7.7/32

root@Olive# run show route 7.7.7.7/32 logical-system r2 detail | match "label|Protocol next hop"
                Label operation: Push 17
                Label TTL action: prop-ttl
                Protocol next hop: 1.1.1.1
                VPN Label: 17
                Label operation: Push 17
                Label TTL action: prop-ttl
                Protocol next hop: 1.1.1.1
                VPN Label: 17

From above, can see that r2 forward label l7 to next hop r1 directly as r2 and r1 is connected
directly. There is just one VPN label here and the out-lable was poped as its destination is 1.1.1.1.
R1 will pop the label and forward into vpn-ab.inet.0 once it received VPN label

root@Olive# run show route label 17 logical-system r1 

mpls.0: 10 destinations, 10 routes (10 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

17                 *[VPN/0] 00:17:26
                      to table vpn-ab.inet.0, Pop

So R4 and R5 can reach to 7.7.7.7

root@Olive# run ping 7.7.7.7 logical-system r4 source 4.4.4.4 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.031/5.524/15.461/5.169 ms

root@Olive# run ping 7.7.7.7 logical-system r5 source 5.5.5.5 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.598/3.563/4.043/0.502 ms

So R6 and R8 can reach to 7.7.7.7

root@Olive# run ping 7.7.7.7 logical-system r6 source 6.6.6.6 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.872/2.576/3.148/0.468 ms

root@Olive# run ping 7.7.7.7 logical-system r8 source 8.8.8.8 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.459/2.442/3.564/0.706 ms

Next test the BGP protocol between PE-CE. As the following, The static key wards of the policy that
defined before should be replaced by bgp.

root@Olive# show r1 policy-options
policy-statement vpn-a-export {
    term 1 {
        from {
            protocol [ static direct ];
            interface em1.16;
        }
        then {
            community add vpn-a;
            accept;
        }
    }
    term 2 {
        then reject;
    }
}
policy-statement vpn-a-import {
    term 1 {
        from {
            protocol bgp;
            community vpn-a;
        }
        then accept;
    }
    term 2 {
        then reject;
    }
}
policy-statement vpn-ab-export {
    term 1 {
        from {
            protocol [ static direct ];
            interface em1.17;
        }
        then {
            community add vpn-a;
            community add vpn-b;
            accept;
        }
    }
    term 2 {
        then reject;
    }
}
policy-statement vpn-ab-import {
    term 1 {
        from {
            protocol bgp;              
            community [ vpn-a vpn-b ];
        }
        then accept;
    }
    term 2 {
        then reject;
    }
}
policy-statement vpn-b-export {
    term 1 {
        from {
            protocol [ static direct ];
            interface em1.18;
        }
        then {
            community add vpn-b;
            accept;
        }
    }
    term 2 {
        then reject;
    }
}
policy-statement vpn-b-import {
    term 1 {
        from {
            protocol bgp;
            community vpn-b;
        }
        then accept;
    }
    term 2 {
        then reject;
    }
}
community vpn-a members target:100:1;
community vpn-b members target:100:2;

Meanwhile, the default routing configured before should be deleted too. Then configure BGP routing
protocol, redistribute routes into BGP.

root@Olive# show r6 protocols bgp
group ebgp {
    type external;
    export to-ebgp;
    neighbor 192.168.16.1 {
        peer-as 100;
    }
}

root@Olive# show r7 protocols bgp   
group ebgp {
    type external;
    export to-ebgp;
    neighbor 192.168.17.1 {
        peer-as 100;
    }
}

root@Olive# show r8 protocols bgp   
group ebgp {
    type external;
    export to-ebgp;
    neighbor 192.168.18.1 {
        peer-as 100;
    }
}

Change R1 routing-instance protocol to BGP

root@Olive# show r1 routing-instances
vpn-a {
    instance-type vrf;
    interface em1.16;
    route-distinguisher 100:1;
    vrf-import vpn-a-import;
    vrf-export vpn-a-export;
    vrf-table-label;
    protocols {
        bgp {
            group ebgp-r6 {
                type external;
                family inet {
                    unicast {
                        rib-group vpn-a-ab;
                    }
                }
                neighbor 192.168.16.6 {
                    peer-as 600;
                }
            }
        }
    }
}
vpn-ab {
    instance-type vrf;
    interface em1.17;
    route-distinguisher 100:3;
    vrf-import vpn-ab-import;
    vrf-export vpn-ab-export;
    vrf-table-label;
    protocols {
        bgp {
            group ebgp-r7 {
                type external;
                family inet {
                    unicast {
                        rib-group vpn-a-b-ab;
                    }
                }
                neighbor 192.168.17.7 {
                    peer-as 700;
                }
            }
        }
    }
}
vpn-b {                                
    instance-type vrf;
    interface em1.18;
    route-distinguisher 100:2;
    vrf-import vpn-b-import;
    vrf-export vpn-b-export;
    vrf-table-label;
    protocols {
        bgp {
            group ebgp-r8 {
                type external;
                family inet {
                    unicast {
                        rib-group vpn-b-ab;
                    }
                }
                neighbor 192.168.18.8 {
                    peer-as 800;
                }
            }
        }
    }
}

Commit configuration and then ping 7.7.7.7 in CE R4

root@Olive# run ping 7.7.7.7 logical-system r4 source 4.4.4.4 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.417/5.784/19.674/7.045 ms

root@Olive# run ping 7.7.7.7 logical-system r6 source 6.6.6.6 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.439/1.820/2.330/0.340 ms

root@Olive# run ping 7.7.7.7 logical-system r5 source 5.5.5.5 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.256/1.506/1.734/0.157 ms

root@Olive# run ping 7.7.7.7 logical-system r8 source 8.8.8.8 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.562/2.183/2.874/0.452 ms

Below is the limit when use the routing table group.
Complicated configuration. There should define one routing table group for per routing-instance in order to import route conveniently. (In above simulation, there defined a rib-group for per instance )
There should define one routing table group for per protocol in order to import routing. (In above simulation, there configured rib-group under static and BGP in routing instance.)
In order to breakthrough above limit, the JUNOS routing auto-export feature can be used.
It will check the exsitent policy and determine which routing table will import or export routing.
And import or export routing according to the specified value of RT community.
There is no need to define rib-groups after enable auto export. So the rib-groups should be deleted on r1 and delete the rib-group under the routing-instance protocol as well.

root@Olive# show r1 routing-options            
rib-groups {
    vpn-a-ab {
        import-rib [ vpn-a.inet.0 vpn-ab.inet.0 ];
    }
    vpn-b-ab {
        import-rib [ vpn-b.inet.0 vpn-ab.inet.0 ];
    }
    vpn-a-b-ab {
        import-rib [ vpn-ab.inet.0 vpn-a.inet.0 vpn-b.inet.0 ];
    }
}

root@Olive# delete r1 routing-options rib-groups
Next just enable auto-export under instance, and there is just need the basic configuration under protocols.

root@Olive# show r1 routing-instances
vpn-a {
    instance-type vrf;
    interface em1.16;
    route-distinguisher 100:1;
    vrf-import vpn-a-import;
    vrf-export vpn-a-export;
    vrf-table-label;
    routing-options {
        auto-export;
    }
    protocols {
        bgp {
            group ebgp-r6 {
                type external;
                neighbor 192.168.16.6 {
                    peer-as 600;
                }
            }
        }
    }
}
vpn-ab {
    instance-type vrf;
    interface em1.17;
    route-distinguisher 100:3;
    vrf-import vpn-ab-import;
    vrf-export vpn-ab-export;
    vrf-table-label;
    routing-options {
        auto-export;
    }
    protocols {
        bgp {
            group ebgp-r7 {
                type external;
                neighbor 192.168.17.7 {
                    peer-as 700;
                }
            }
        }
    }
}
vpn-b {
    instance-type vrf;
    interface em1.18;
    route-distinguisher 100:2;
    vrf-import vpn-b-import;          
    vrf-export vpn-b-export;
    vrf-table-label;
    routing-options {
        auto-export;
    }
    protocols {
        bgp {
            group ebgp-r8 {
                type external;
                neighbor 192.168.18.8 {
                    peer-as 800;
                }
            }
        }
    }
}

After running that configuration, the route will be exchange in each instance. So CE of vpn-a and vpn-b will learn the routing item 7.7.7.7/32 in vpn-ab.

root@Olive# run show route protocol bgp logical-system r6   

inet.0: 6 destinations, 6 routes (6 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

4.4.4.4/32         *[BGP/170] 00:00:20, localpref 100
                      AS path: 100 I
                    > to 192.168.16.1 via em2.16
7.7.7.7/32         *[BGP/170] 00:00:57, localpref 100
                      AS path: 100 700 I
                    > to 192.168.16.1 via em2.16
192.168.24.0/24    *[BGP/170] 00:00:20, localpref 100
                      AS path: 100 I
                    > to 192.168.16.1 via em2.16

root@Olive# run show route protocol bgp logical-system r8   

inet.0: 6 destinations, 6 routes (6 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

5.5.5.5/32         *[BGP/170] 00:00:24, localpref 100
                      AS path: 100 I
                    > to 192.168.18.1 via em2.18
7.7.7.7/32         *[BGP/170] 00:01:05, localpref 100
                      AS path: 100 700 I
                    > to 192.168.18.1 via em2.18
192.168.35.0/24    *[BGP/170] 00:00:24, localpref 100
                      AS path: 100 I
                    > to 192.168.18.1 via em2.18

root@Olive# run ping 7.7.7.7 logical-system r4 source 4.4.4.4 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.265/4.622/8.157/1.996 ms

root@Olive# run ping 7.7.7.7 logical-system r5 source 5.5.5.5 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.424/3.051/3.609/0.492 ms

root@Olive# run ping 7.7.7.7 logical-system r6 source 6.6.6.6 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.390/1.667/2.008/0.253 ms

root@Olive# run ping 7.7.7.7 logical-system r8 source 8.8.8.8 rapid
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.252/3.330/7.172/2.064 ms

auto-export also can be configured for all the VRF instance, in this way all the auto-export
command under routing-instance could be deleted

[edit logical-systems r1 routing-instances]
root@Olive# delete vpn-a routing-options auto-export

[edit logical-systems r1 routing-instances]
root@Olive# delete vpn-ab routing-options auto-export

[edit logical-systems r1 routing-instances]
root@Olive# delete vpn-b routing-options auto-export

[edit]
root@Olive# show groups
vrf-export-all {
    logical-systems {
        <*> {
            routing-instances {
                <*> {
                    routing-options {
                        auto-export;
                    }
                }
            }
        }
    }
}

[edit]
root@Olive# set apply-groups vrf-export-all

root@Olive# run show configuration logical-systems r1 routing-instances | display inheritance   
vpn-a {
    instance-type vrf;
    interface em1.16;
    route-distinguisher 100:1;
    vrf-import vpn-a-import;
    vrf-export vpn-a-export;
    vrf-table-label;
    ##
    ## 'routing-options' was inherited from group 'vrf-export-all'
    ##
    routing-options {
        ##
        ## 'auto-export' was inherited from group 'vrf-export-all'
        ##
        auto-export;
    }
    protocols {
        bgp {
            group ebgp-r6 {
                type external;
                neighbor 192.168.16.6 {
                    peer-as 600;
                }
            }
        }
    }
}
vpn-ab {
    instance-type vrf;
    interface em1.17;
    route-distinguisher 100:3;
    vrf-import vpn-ab-import;
    vrf-export vpn-ab-export;
    vrf-table-label;
    ##
    ## 'routing-options' was inherited from group 'vrf-export-all'
    ##
    routing-options {
        ##
        ## 'auto-export' was inherited from group 'vrf-export-all'
        ##
        auto-export;
    }
    protocols {
        bgp {
            group ebgp-r7 {
                type external;         
                neighbor 192.168.17.7 {
                    peer-as 700;
                }
            }
        }
    }
}
vpn-b {
    instance-type vrf;
    interface em1.18;
    route-distinguisher 100:2;
    vrf-import vpn-b-import;
    vrf-export vpn-b-export;
    vrf-table-label;
    ##
    ## 'routing-options' was inherited from group 'vrf-export-all'
    ##
    routing-options {
        ##
        ## 'auto-export' was inherited from group 'vrf-export-all'
        ##
        auto-export;
    }
    protocols {
        bgp {
            group ebgp-r8 {
                type external;
                neighbor 192.168.18.8 {
                    peer-as 800;
                }
            }
        }
    }
}

Juniper MPLS L3VPN

MPLS L3VPN

Configure MPLS protocol and RSVP, Create RSVP LSP.
On this simulation we create LSP in each PE router.
Because R1/R2/R3 in same OSPF area, so it doesn't need to disable CSPF.
root@Olive# show r1 protocols
rsvp {
    interface em1.12;
    interface em1.13;
}
mpls {
    label-switched-path r1-r2 {
        to 2.2.2.2;
    }
    label-switched-path r1-r3 {
        to 3.3.3.3;
    }
    interface em1.12;
    interface em1.13;
}


root@Olive# show r2 protocols
rsvp {
    interface em2.12;
    interface em2.23;
}
mpls {
    label-switched-path r2-r1 {
        to 1.1.1.1;
    }
    label-switched-path r2-r3 {
        to 3.3.3.3;
    }
    interface em2.12;
    interface em2.23;
}

root@Olive# show r3 protocols
rsvp {
    interface em1.23;
    interface em2.13;
}
mpls {
    label-switched-path r3-r1 {
        to 1.1.1.1;
    }
    label-switched-path r3-r2 {
        to 2.2.2.2;
    }
    interface em1.23;
    interface em2.13;
}

RSVP Session Between PE.
root@Olive# run show rsvp session logical-system r1
Ingress RSVP: 2 sessions
To              From            State   Rt Style Labelin Labelout LSPname
2.2.2.2         1.1.1.1         Up       0  1 FF       -        3 r1-r2
3.3.3.3         1.1.1.1         Up       0  1 FF       -        3 r1-r3
Total 2 displayed, Up 2, Down 0

Egress RSVP: 2 sessions
To              From            State   Rt Style Labelin Labelout LSPname
1.1.1.1         3.3.3.3         Up       0  1 FF       3        - r3-r1
1.1.1.1         2.2.2.2         Up       0  1 FF       3        - r2-r1
Total 2 displayed, Up 2, Down 0

Transit RSVP: 0 sessions
Total 0 displayed, Up 0, Down 0

root@Olive# run show rsvp session logical-system r2   
Ingress RSVP: 2 sessions
To              From            State   Rt Style Labelin Labelout LSPname
1.1.1.1         2.2.2.2         Up       0  1 FF       -        3 r2-r1
3.3.3.3         2.2.2.2         Up       0  1 FF       -        3 r2-r3
Total 2 displayed, Up 2, Down 0

Egress RSVP: 2 sessions
To              From            State   Rt Style Labelin Labelout LSPname
2.2.2.2         1.1.1.1         Up       0  1 FF       3        - r1-r2
2.2.2.2         3.3.3.3         Up       0  1 FF       3        - r3-r2
Total 2 displayed, Up 2, Down 0

Transit RSVP: 0 sessions
Total 0 displayed, Up 0, Down 0

root@Olive# run show rsvp session logical-system r3   
Ingress RSVP: 2 sessions
To              From            State   Rt Style Labelin Labelout LSPname
1.1.1.1         3.3.3.3         Up       0  1 FF       -        3 r3-r1
2.2.2.2         3.3.3.3         Up       0  1 FF       -        3 r3-r2
Total 2 displayed, Up 2, Down 0

Egress RSVP: 2 sessions
To              From            State   Rt Style Labelin Labelout LSPname
3.3.3.3         1.1.1.1         Up       0  1 FF       3        - r1-r3
3.3.3.3         2.2.2.2         Up       0  1 FF       3        - r2-r3
Total 2 displayed, Up 2, Down 0

Transit RSVP: 0 sessions
Total 0 displayed, Up 0, Down 0

By default OSPF did not support TE，so it must enable TE in OSPF protocol.

root@Olive1# set r1 protocols ospf traffic-engineering

root@Olive1# set r2 protocols ospf traffic-engineering

root@Olive1# set r3 protocols ospf traffic-engineering

MPLS/VPN packet use inet-vpn NLRI for advertise, so it must enable VPNV4 family in BGP protocol.
root@Olive# show r1 protocols bgp group ibgp
type internal;
local-address 1.1.1.1;
neighbor 2.2.2.2 {
    family inet {
        unicast;
    }
    family inet-vpn {
        unicast;
    }
}
neighbor 3.3.3.3 {
    family inet {
        unicast;
    }
    family inet-vpn {
        unicast;
    }
}

root@Olive# show r2 protocols bgp group ibgp   
type internal;
local-address 2.2.2.2;
neighbor 1.1.1.1 {
    family inet {
        unicast;
    }
    family inet-vpn {
        unicast;
    }
}
neighbor 3.3.3.3 {
    family inet {
        unicast;
    }
    family inet-vpn {
        unicast;
    }
}

root@Olive# show r3 protocols bgp group ibgp   
type internal;
local-address 3.3.3.3;
neighbor 1.1.1.1 {
    family inet {
        unicast;
    }
    family inet-vpn {
        unicast;
    }
}
neighbor 2.2.2.2 {
    family inet {
        unicast;
    }
    family inet-vpn {
        unicast;
    }
}

Check VPNV4 neighbor or VPNV4 state in PE
root@Olive# run show bgp neighbor logical-system r1
Peer: 2.2.2.2+61392 AS 100     Local: 1.1.1.1+179 AS 100 
  Type: Internal    State: Established    Flags:
  Last State: OpenConfirm   Last Event: RecvKeepAlive
  Last Error: None
  Options:
  Address families configured: inet-unicast inet-vpn-unicast
  Local Address: 1.1.1.1 Holdtime: 90 Preference: 170
  Number of flaps: 0
  Peer ID: 2.2.2.2         Local ID: 1.1.1.1           Active Holdtime: 90
  Keepalive Interval: 30         Peer index: 1  
  BFD: disabled, down
  NLRI for restart configured on peer: inet-unicast inet-vpn-unicast
  NLRI advertised by peer: inet-unicast inet-vpn-unicast
  NLRI for this session: inet-unicast inet-vpn-unicast
  Peer supports Refresh capability (2)
  Restart time configured on the peer: 120
  Stale routes from peer are kept for: 300
  Restart time requested by this peer: 120
  NLRI that peer supports restart for: inet-unicast inet-vpn-unicast
  NLRI that restart is negotiated for: inet-unicast inet-vpn-unicast
  NLRI of received end-of-rib markers: inet-unicast inet-vpn-unicast
  NLRI of all end-of-rib markers sent: inet-unicast inet-vpn-unicast
  Peer supports 4 byte AS extension (peer-as 100)

Now PE will have two BGP neighbor state, inet.0 and bgp.l3vpn.0
root@Olive# run show bgp summary logical-system r1
Groups: 1 Peers: 2 Down peers: 0
Table          Tot Paths  Act Paths Suppressed    History Damp State    Pending
inet.0                 0          0          0          0          0          0
bgp.l3vpn.0            2          2          0          0          0          0
Peer                     AS      InPkt     OutPkt    OutQ   Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
2.2.2.2                 100         53         55       0       0       21:16 Establ
  inet.0: 0/0/0/0
  bgp.l3vpn.0: 1/1/1/0
3.3.3.3                 100         53         56       0       0       21:17 Establ
  inet.0: 0/0/0/0
  bgp.l3vpn.0: 1/1/1/0

Still can not receive any VPN routes from another PE, and bgp.l3vpn.0 did not has any active routes, Because PE did not configure VPN customer yet.
Use routing-instance for VPN customer in PE, and each CE can belong to one VRF.
JUNOS use routing-instance for separate different VRF.
root@Olive# show r1 routing-instances
vpn-a {
    instance-type vrf;
    interface em1.16;
    route-distinguisher 100:1;
    vrf-table-label;
    protocols {
        ospf {
            area 0.0.0.0 {
                interface em1.16;
            }
        }
    }
}
vpn-b {
    instance-type vrf;
    interface em1.17;
    route-distinguisher 100:2;
    vrf-table-label;
    protocols {
        ospf {
            area 0.0.0.0 {
                interface em1.17;
            }
        }
    }
}

root@Olive# show r2 routing-instances   
vpn-a {
    instance-type vrf;
    interface em2.24;
    route-distinguisher 100:1;
    vrf-table-label;
    protocols {
        ospf {
            area 0.0.0.0 {
                interface em2.24;
            }
        }
    }
}

root@Olive# show r3 routing-instances   
vpn-b {
    instance-type vrf;
    interface em2.35;
    route-distinguisher 100:2;
    vrf-table-label;
    protocols {
        ospf {
            area 0.0.0.0 {
                interface em2.35;
            }
        }
    }
}

Commit and Check OSPF neighbor:
root@Olive# run show ospf neighbor instance all logical-system r1    
Instance: master
Address          Interface              State     ID               Pri  Dead
192.168.12.2     em1.12                 Full      2.2.2.2          128    34
192.168.13.3     em1.13                 Full      3.3.3.3          128    37

Instance: vpn-a
Address          Interface              State     ID               Pri  Dead
192.168.16.6     em1.16                 Full      6.6.6.6          128    38

Instance: vpn-b
Address          Interface              State     ID               Pri  Dead
192.168.17.7     em1.17                 Full      7.7.7.7          128    37

root@Olive# run show ospf neighbor instance all logical-system r2   
Instance: master
Address          Interface              State     ID               Pri  Dead
192.168.12.1     em2.12                 Full      1.1.1.1          128    33
192.168.23.3     em2.23                 Full      3.3.3.3          128    32

Instance: vpn-a
Address          Interface              State     ID               Pri  Dead
192.168.24.4     em2.24                 Full      4.4.4.4          128    31

root@Olive# run show ospf neighbor instance all logical-system r3   
Instance: master
Address          Interface              State     ID               Pri  Dead
192.168.23.2     em1.23                 Full      2.2.2.2          128    32
192.168.13.1     em2.13                 Full      1.1.1.1          128    34

Instance: vpn-b
Address          Interface              State     ID               Pri  Dead
192.168.35.5     em2.35                 Full      5.5.5.5          128    36

Command show route, It can not show vpn route table
To learn the VPN routes from the same VPN instance or different VPN instance must use RT in VPN instance.
In JUNOS VPN routing-instance we can use vrf-target or vrf-import and vrf-export policy
root@Olive# show r1 policy-options
policy-statement vpn-a-export {
    term 1 {
        from protocol ospf;
        then {
            community add vpn-a;
            accept;
        }
    }
    term 2 {
        then reject;
    }
}
policy-statement vpn-a-import {
    term 1 {
        from {
            protocol bgp;
            community vpn-a;
        }
        then accept;
    }
}
policy-statement vpn-b-export {
    term 1 {                           
        from protocol ospf;
        then {
            community add vpn-b;
            accept;
        }
    }
    term 2 {
        then reject;
    }
}
policy-statement vpn-b-import {
    term 1 {
        from {
            protocol bgp;
            community vpn-b;
        }
        then accept;
    }
}
community vpn-a members target:100:1;
community vpn-b members target:100:2;

This community configuration define the RT attribute.

Now all PE's could learn the VPN routes, check bgp.l3vpn.0 routing table

root@Olive# run show bgp summary logical-system r1
Groups: 1 Peers: 2 Down peers: 0
Table          Tot Paths  Act Paths Suppressed    History Damp State    Pending
inet.0                 0          0          0          0          0          0
bgp.l3vpn.0            2          2          0          0          0          0
Peer                     AS      InPkt     OutPkt    OutQ   Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...
2.2.2.2                 100         81         83       0       0       34:02 Establ
  inet.0: 0/0/0/0
  bgp.l3vpn.0: 1/1/1/0
  vpn-a.inet.0: 1/1/1/0
3.3.3.3                 100         81         84       0       0       34:03 Establ
  inet.0: 0/0/0/0
  bgp.l3vpn.0: 1/1/1/0
  vpn-b.inet.0: 1/1/1/0

  

Check the VPN routes from CE protocol OSPF

Instance[name].inet.0 route table will show the route from CE

root@Olive# run show route table vpn-a.inet.0 logical-system r1 protocol ospf  

vpn-a.inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

6.6.6.6/32         *[OSPF/10] 00:26:48, metric 1
                    > to 192.168.16.6 via em1.16
224.0.0.5/32       *[OSPF/10] 00:38:22, metric 1
                      MultiRecv

root@Olive# run show route table vpn-b.inet.0 logical-system r1 protocol ospf  

vpn-b.inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

7.7.7.7/32         *[OSPF/10] 00:26:51, metric 1
                    > to 192.168.17.7 via em1.17
224.0.0.5/32       *[OSPF/10] 00:38:25, metric 1
                      MultiRecv

Check PE bgp.l3vpn.0 routes table
root@Olive# run show route table bgp.l3vpn.0 logical-system r1

bgp.l3vpn.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

100:1:4.4.4.4/32               
                   *[BGP/170] 00:28:31, MED 1, localpref 100, from 2.2.2.2
                      AS path: I
                    > to 192.168.12.2 via em1.12, label-switched-path r1-r2
100:2:5.5.5.5/32               
                   *[BGP/170] 00:28:27, MED 1, localpref 100, from 3.3.3.3
                      AS path: I
                    > to 192.168.13.3 via em1.13, label-switched-path r1-r3

The RD in every VPN route, RD(64bits)+IPV4(32bits) = 96bits, it's the VPNV4 address prefix length.
Check how to reach to another PE.
root@Olive# run show route table inet.3 logical-system r1

inet.3: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

2.2.2.2/32         *[RSVP/7/1] 00:30:58, metric 1
                    > to 192.168.12.2 via em1.12, label-switched-path r1-r2
3.3.3.3/32         *[RSVP/7/1] 00:30:58, metric 1
                    > to 192.168.13.3 via em1.13, label-switched-path r1-r3
R4 and R6 belong to the same VPN customer site, can learn r4 or r6’s VPN routes in PE, why CE did not learn VPN routes in each other ? Because BGP did not export VPN routes to IGP, Create policy to solve this problem.
root@Olive# show r1 policy-options
policy-statement bgp-to-vpn-a {
    term 1 {
        from {
            protocol bgp;
            community vpn-a;
        }
        then accept;
    }
    term 2 {
        then reject;
    }
}
policy-statement bgp-to-vpn-b {
    term 1 {
        from {
            protocol bgp;
            community vpn-b;
        }
        then accept;
    }
    term 2 {
        then reject;
    }
}

root@Olive# show r1 routing-instances vpn-a protocols
ospf {
    export bgp-to-vpn-a;
    area 0.0.0.0 {
        interface em1.16;
    }
}

[edit logical-systems]
root@Olive1# show r1 routing-instances vpn-b protocols   
ospf {
    export bgp-to-vpn-b;
    area 0.0.0.0 {
        interface em1.17;
    }
}
Also same command policy configuration on r2 and r3

Commit and check CE routing table

root@Olive# run show route protocol ospf logical-system r4

inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

6.6.6.6/32         *[OSPF/10] 00:38:39, metric 2
                    > to 192.168.24.2 via em1.24
224.0.0.5/32       *[OSPF/10] 00:50:27, metric 1
                      MultiRecv

root@Olive# run show route protocol ospf logical-system r5   

inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

7.7.7.7/32         *[OSPF/10] 00:38:42, metric 2
                    > to 192.168.35.3 via em1.35
224.0.0.5/32       *[OSPF/10] 00:50:29, metric 1
                      MultiRecv

root@Olive# run show route protocol ospf logical-system r6   

inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

4.4.4.4/32         *[OSPF/10] 00:38:43, metric 2
                    > to 192.168.16.1 via em2.16
224.0.0.5/32       *[OSPF/10] 00:50:30, metric 1
                      MultiRecv

root@Olive# run show route protocol ospf logical-system r7   

inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

5.5.5.5/32         *[OSPF/10] 00:40:21, metric 2
                    > to 192.168.17.1 via em2.17
224.0.0.5/32       *[OSPF/10] 00:52:08, metric 1
                      MultiRecv

root@Olive# run ping 6.6.6.6 source 4.4.4.4 logical-system r4 rapid
PING 6.6.6.6 (6.6.6.6): 56 data bytes
!!!!!
--- 6.6.6.6 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.348/3.356/7.524/2.211 ms

root@Olive# run ping 7.7.7.7 source 5.5.5.5 logical-system r5 rapid   
PING 7.7.7.7 (7.7.7.7): 56 data bytes
!!!!!
--- 7.7.7.7 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 1.375/2.037/3.137/0.635 ms

root@Olive# run traceroute 4.4.4.4 source 6.6.6.6 logical-system r6
traceroute to 4.4.4.4 (4.4.4.4) from 6.6.6.6, 30 hops max, 40 byte packets
 1  192.168.16.1 (192.168.16.1)  1.274 ms  0.529 ms  0.359 ms
 2  4.4.4.4 (4.4.4.4)  0.643 ms  0.587 ms  0.954 ms

root@Olive# run traceroute 5.5.5.5 source 7.7.7.7 logical-system r7
traceroute to 5.5.5.5 (5.5.5.5) from 7.7.7.7, 30 hops max, 40 byte packets
 1  192.168.17.1 (192.168.17.1)  0.383 ms  0.438 ms  0.256 ms
 2  5.5.5.5 (5.5.5.5)  0.926 ms  0.685 ms  0.933 ms

To communicate between different VPN customers, add other customer’s RT community in routing-instance.

root@Olive# show r1 routing-instances
vpn-a {
    instance-type vrf;
    interface em1.16;
    route-distinguisher 100:1;
    vrf-import [ vpn-a-import vpn-b-import ];
    vrf-export vpn-a-export;
    vrf-table-label;
    protocols {
        ospf {
            export bgp-to-vpn-a;
            area 0.0.0.0 {
                interface em1.16;
            }
        }
    }
}
vpn-b {
    instance-type vrf;
    interface em1.17;
    route-distinguisher 100:2;
    vrf-import [ vpn-b-import vpn-a-import ];
    vrf-export vpn-b-export;
    vrf-table-label;
    protocols {
        ospf {
            export bgp-to-vpn-b;
            area 0.0.0.0 {
                interface em1.17;
            }
        }
    }
}

root@Olive# show r1 policy-options policy-statement bgp-to-vpn-a      
term 1 {
    from {
        protocol bgp;
        community [ vpn-a vpn-b ];
    }
    then accept;
}
term 2 {
    then reject;
}

root@Olive# show r1 policy-options policy-statement bgp-to-vpn-b   
term 1 {
    from {
        protocol bgp;
        community [ vpn-b vpn-a ];
    }
    then accept;
}
term 2 {
    then reject;
}

Add another VPN-RT community in R2 and R3

root@Olive# show r2 policy-options community vpn-b 
members target:100:2;

root@Olive# show r3 policy-options community vpn-a  
members target:100:1;

Now check routing table on CE
root@Olive# run show route protocol ospf logical-system r6

inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

4.4.4.4/32         *[OSPF/10] 00:05:27, metric 2
                    > to 192.168.16.1 via em2.16
5.5.5.5/32         *[OSPF/10] 00:05:27, metric 2
                    > to 192.168.16.1 via em2.16
192.168.24.0/24    *[OSPF/150] 00:05:27, metric 0, tag 3489661028
                    > to 192.168.16.1 via em2.16
192.168.35.0/24    *[OSPF/150] 00:05:27, metric 0, tag 3489661028
                    > to 192.168.16.1 via em2.16
224.0.0.5/32       *[OSPF/10] 00:06:43, metric 1
                      MultiRecv