Active Nodes
Active routers in this lab: EDGE-1, EDGE-4, CE-CORP-1, CE-CORP-2
Key Concepts
The Backdoor Link Problem
When two CE sites connect via a direct backdoor link in addition to the MPLS VPN, OSPF may prefer the backdoor path because OSPF intra-area routes have lower administrative distance than OSPF inter-area routes redistributed from BGP. The result: traffic bypasses the MPLS backbone, potentially missing QoS, security policies, and billing. The OSPF sham-link creates a virtual OSPF intra-area adjacency between PE routers, making the MPLS path appear as an intra-area route competing fairly with the backdoor.
Sham-Link Configuration Requirements
The sham-link source and destination must be loopback addresses within the VRF that are reachable via BGP (not OSPF). If they were OSPF routes, OSPF would see a routing loop. The loopbacks are advertised into BGP VPNv4 via redistribute connected under the VRF BGP process. The sham-link cost should be set lower than the backdoor link cost to ensure MPLS path preference.
Verification and Failover
With the sham-link up, remote CE prefixes appear as OSPF O (intra-area) rather than O IA or redistributed external. When the sham-link fails (PE-PE BGP down), OSPF falls back to the backdoor link automatically — this is the correct failover behavior. Use debug ip ospf sham-link to observe sham-link state transitions.
Critical Configuration
interface Loopback10 ip vrf forwarding CORP ip address 10.99.1.1 255.255.255.255 router ospf 10 vrf CORP area 100 sham-link 10.99.1.1 10.99.1.2 cost 10 authentication message-digest message-digest-key 7 md5 Nx9#mP2@qK router bgp 65000 address-family ipv4 vrf CORP redistribute connected network 10.99.1.1 mask 255.255.255.255