Juniper IP SERVICES - CONFIGURATION GUIDE V 11.1.X, Configuration Manual

Page: 111 / 366

11.
Configure a null route for the inside global addresses to prevent routing loops
when no matching translation exists.
host1:blue(config)# ip route 12.220.1.0 255.255.0.0 null 0
Cross-VRF Example
In MPLS VPN configurations, you might want to offer public Internet access to VPN
subscribers. MPLS VPNs are enabled through the use of VRFs. If a VPN is using a
private or overlapping address space, you can use NAT to enable access to the public
network because the NAT implementation is both VR and VRF aware. Figure 9 on
page 85 illustrates how the subscriber interface feature of the router is used in
conjunction with NAT to connect the VPNs to the public network.
Figure 9: Cross-VRF Example
VRF11 is the local (this PE) representation of the MPLS VPN and connects enterpriseA
to the VPN. Enterprise A communicates to VRFs in other PE devices (the rest of the
VPN) through RFC2547bis (MPLS VPNs). VR1, of which the VRF is administratively
a member, represents the public network. The interface to EnterpriseA is marked
as an inside interface. The normal steps for configuring inside source translation are
applied. A subscriber interface is created off the uplink to the core network and
anchored in the VRF. A DA-based demultiplexer matching the inside global address
range is configured on the subscriber interface. The subscriber interface is marked
as an outside interface.
To configure this example:
1.
Enter the correct virtual routing and forwarding instance.
host1(config)# virtual-router vr1:vrf11
2.
Mark the inside interfaces.
host1:vr1:vrf11(config)# interface fast-ethernet 6/1
host1:vr1:vrf11 (config-interface)# ip nat inside
host1:vr1:vrf11 (config-interface)# exit
3.
Set the primary interface to DA-type demultiplexer (for subsequent shared
interfaces).
host1:vr1(config)# interface atm 12/0.101
NAT Configuration Examples
■ 85
Chapter 2: Configuring NAT