Juniper JUNOSE, Configuration Manual

Page: 437 / 738

Figure 83: Route Target Configuration for a Full-Mesh VPN
Hub-and-Spoke VPNs
In a hub-and-spoke VPN, the spoke sites in the VPN can communicate only with the
hub sites; they cannot communicate with other spoke sites, as shown in Figure 84
on page 401.
Figure 84: Site Connectivity in a Hub-and-Spoke VPN
Figure 85 on page 402 shows how to configure the VRF import and export route
targets to build a hub-and-spoke VPN. Each spoke VRF has the same export route
target, 100:12. The hub VRF has its import route target set to 100:12, so it accepts
only routes from the spoke VRFs. Each spoke VRF has the same import route target,
100:11. Every route advertised by any spoke has an attached route target of 100:12.
Because that route target does not match the import route target of any spoke, the
spokes cannot accept any routes from another spoke. However, the hub VRF has an
export route target of 100:11, so routes advertised by the hub do match the import
target of each spoke and are accepted by all of the spokes.
Using Route Targets to Configure VPN Topologies
■ 401
Chapter 5: Configuring BGP-MPLS Applications