Active Nodes
Active routers in this lab: EDGE-1, EDGE-4, CE-CORP-1, CE-CORP-2
Key Concepts
PE-CE BGP — When to Use
PE-CE BGP is preferred when the customer requires full control over routing policy, needs to advertise specific prefixes (not aggregate), or when the customer AS is the same on all sites requiring AS override on the PE. Unlike PE-CE OSPF which redistributes, BGP maintains end-to-end prefix granularity with full AS-path visibility through the MPLS backbone (after stripping private AS on export).
AS Override Mechanics
When PE-1 receives a prefix from CE-CORP-1 (AS 65500), it carries AS-path "65500". When this prefix is exported as VPNv4 and later imported by PE-4 for CE-CORP-2, PE-4 would normally not send it to CE-CORP-2 (also AS 65500) because of BGP loop prevention. With neighbor CE allowas-in 1 on the CE, the CE accepts one occurrence of its own AS. Alternatively, as-override on the PE replaces 65500 with 65000 before advertising — CE-CORP-2 sees AS-path "65000" and accepts it.
Customer Route Leaking Control
Using maximum-prefix 1000 under the VRF BGP neighbor protects the PE from a misconfigured CE advertising the full Internet table. Always set this in production. Combine with prefix-list inbound on the PE to only accept specific CE prefixes — this is a critical security boundary in any SP MPLS deployment.
Critical Configuration
router bgp 65000 address-family ipv4 vrf CORP neighbor 10.1.100.1 remote-as 65500 neighbor 10.1.100.1 activate neighbor 10.1.100.1 as-override neighbor 10.1.100.1 maximum-prefix 1000 80 neighbor 10.1.100.1 prefix-list ALLOW-CE-PREFIXES in exit-address-family ip prefix-list ALLOW-CE-PREFIXES permit 192.168.100.0/24 ip prefix-list ALLOW-CE-PREFIXES permit 10.255.6.1/32
router bgp 65500 neighbor 10.1.100.0 remote-as 65000 neighbor 10.1.100.0 allowas-in 1 address-family ipv4 network 192.168.100.0 mask 255.255.255.0 neighbor 10.1.100.0 activate