CloudLabBox
Try the free demo

MPLS and L3VPN lab 7 of 11

Route-target design: hub-and-spoke and an extranet

A retail chain wants every shop-to-shop packet to pass through head office, and only the shops may reach a supplier's server. Build both with nothing but route targets, then fix the two loop-prevention rules that get in the way, with allowas-in and as-override.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 3,072 MB in total. That fits the free demo too.

In your workspace: Shared, then MPLS and L3VPN guided labs, then 07 - Route-target design - hub-and-spoke and an extranet

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
6 vCPU, 3,072 MB
Smallest plan
Lite

The scenario

Wrenfield Networks has won Cedar Retail, a chain with a head office and two shops. Cedar's security team has two rules:

  1. Shops never talk directly. All shop-to-shop traffic passes through the firewall at head office (router HUB here), so it can be inspected.
  2. Shops, and only shops, use a supplier's stock server. That server sits at a separate company, reached through its own VPN. Head office must not be able to reach it, and the supplier must see nothing but the shops.

You won't change a single IP address or BGP session to do this. Route targets do all of it. PE1 and PE2 are directly connected in this lab.

SiteRouterLANASPE and VRF
Head officeHUB192.168.20.0/2465300PE1: HUB-IN and HUB-OUT
Shop 1S1192.168.21.0/2465301PE2: SPOKE1
Shop 2S2192.168.22.0/2465301PE2: SPOKE2
SupplierSVC192.168.30.0/2465302PE2: SERVICES

The route-target plan, which you'll work through below:

RTMeansExported byImported by
65100:21Shop routes, for head officeSPOKE1, SPOKE2HUB-IN
65100:20Routes from head office, for the shopsHUB-OUTSPOKE1, SPOKE2
65100:31Shop routes, for the supplierSPOKE1, SPOKE2SERVICES
65100:30Supplier routes, for the shopsSERVICESSPOKE1, SPOKE2
DeviceInterfaceAddressConnects to
HUBLoopback1192.168.20.1/24
HUBGi0/0172.16.1.2/30PE1 Gi0/1
HUBGi0/1172.16.2.2/30PE1 Gi0/2
PE1Loopback010.255.0.1/32
PE1Gi0/010.0.12.1/30PE2 Gi0/0
PE1Gi0/1172.16.1.1/30HUB Gi0/0
PE1Gi0/2172.16.2.1/30HUB Gi0/1
PE2Loopback010.255.0.2/32
PE2Gi0/010.0.12.2/30PE1 Gi0/0
PE2Gi0/1172.16.21.1/30S1 Gi0/0
PE2Gi0/2172.16.22.1/30S2 Gi0/0
PE2Gi0/3172.16.30.1/30SVC Gi0/0
S1Loopback1192.168.21.1/24
S1Gi0/0172.16.21.2/30PE2 Gi0/1
S2Loopback1192.168.22.1/24
S2Gi0/0172.16.22.2/30PE2 Gi0/2
SVCLoopback1192.168.30.1/24
SVCGi0/0172.16.30.2/30PE2 Gi0/3

What you’ll practise

  • Design a route-target plan for hub-and-spoke and an extranet
  • Explain why a hub needs two VRFs and each spoke its own VRF
  • Use allowas-in to bring routes back through a hub site
  • Use as-override for customer sites that share an AS
  • Prove the traffic path with traceroute and the isolation with a failed ping

The tasks

  1. Why two VRFs at the hub, and one per spoke
  2. Build the hub-and-spoke import and export
  3. Get the routes back in: allowas-in
  4. Two sites with one AS: as-override
  5. Add the extranet

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Route-target design - hub-and-spoke and an extranet6 nodes, 6 links. Every link is listed as text below the diagram.HUBPE1PE2S1S2SVCGi0/0Gi0/1Gi0/1Gi0/2Gi0/0Gi0/0Gi0/2Gi0/0Gi0/1Gi0/0Gi0/3Gi0/0
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HUB Gi0/0 to PE1 Gi0/1
  • HUB Gi0/1 to PE1 Gi0/2
  • PE1 Gi0/0 to PE2 Gi0/0
  • PE2 Gi0/1 to S1 Gi0/0
  • PE2 Gi0/2 to S2 Gi0/0
  • PE2 Gi0/3 to SVC Gi0/0
Nodes in Route-target design: hub-and-spoke and an extranet, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HUBCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PE1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PE2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
S1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
S2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SVCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MPLS and L3VPN guided labs.

  3. Open 07 - Route-target design - hub-and-spoke and an extranet and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MPLS and L3VPN labs

All MPLS and L3VPN labs

Related labs in other courses

CloudLabBox is independent of Cisco, Juniper Networks and MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.