Theoretical foundations and architecture

PE-CE routing defines the boundary exchange of routing information between the provider edge (PE) and customer premises equipment (CE). Three standard architectures exist: 1. Static Routing: ideal for stub branches with simple default or summary routes redistributed into MP-BGP. 2. OSPF as PE-CE: widely deployed by enterprises. To prevent routing loops when an enterprise multi-homes to the MPLS core, OSPF employs the Down Bit (DN-bit in Type 3 Summary LSAs) and Domain Route Tags. A PE router ignores any Type 3 LSA received from a CE with the DN-bit set, suppressing re-injection into MP-BGP. Sham-links can be established across the MPLS core to retain OSPF intra-area preference over backdoor links. 3. eBGP as PE-CE: the carrier gold standard for enterprise interconnects. When customer branches share a uniform autonomous system (e.g., AS 65100), remote CEs reject updates bearing their own ASN due to standard BGP loop prevention. To circumvent this without compromising integrity, the PE implements as-override, replacing the customer ASN with the provider's ASN in the AS_PATH.

The role of the PE-CE protocol

The PE-CE protocol does two things: it passes customer routes into the VRF (the PE learns the CE prefixes) and it delivers routes from the VRF to the CE (the PE hands over the prefixes of remote sites). PEs exchange routes with each other only through MP-BGP, so any customer protocol on the PE has to be re-advertised into BGP (redistribute/import-route/export policy) and in the opposite direction - from BGP into the customer protocol. The provider does not have to use the same protocol as the customer, but must preserve the meaning of the routes.

Static routing

The most predictable option: ip route vrf A <prefix> <next-hop> on the PE and a default route on the CE. Static routes create no neighbors and do not depend on timers, but they do not react to a CE failure: you need BFD (static-route track) or ip route ... track. They enter BGP through redistribute static; without it the customer network will not leave the PE. For large deployments an explicit allowlist (route-map/policy) on export is common practice, otherwise an accidental static route becomes a customer route.

eBGP PE-CE and the same-AS problem

eBGP is the most scalable option: the CE has its own policy, BFD, community tagging and prefix limits. The main trap: all customer sites often use the same AS (65101). PE2 passes the CE2 route with the AS_PATH 65000 65101, and CE2 discards it because it sees its own AS (loop prevention). Two solutions:

  • as-override on the PE: when sending to the CE, the PE replaces all occurrences of the CE AS in the AS_PATH with its own AS (Cisco neighbor ... as-override, Huawei peer ... substitute-as, Junos as-override in the group). The CE is not changed.
  • allowas-in on the CE: the CE permits N occurrences of its own AS (neighbor ... allowas-in 1). This requires changes on the customer side.

A side effect of as-override: the AS_PATH loop protection is lost. If the customer has a backdoor link between sites, a route may come back and loop. The protection is Site of Origin (SoO): when learning from a CE the PE adds the SoO extended community (origin type) to the route; when sending to the same site the PE discards routes with the same SoO. Cisco: set extcommunity soo 65000:11 in the route-map inbound from the CE; Junos: community origin:65000:11.

OSPF PE-CE: the DN bit, domain-id, sham-link

OSPF in a VRF is a separate process instance (router ospf 2 vrf B) with its own LSDB. MP-BGP routes are turned into LSAs on the PE:

  • If the OSPF domain-id is the same on both PEs, the route is presented as inter-area (LSA type 3, Inter-area): the CE considers the sites to be in one domain and prefers such a path by OSPF preference (intra/inter-area before external).
  • If the domain-ids differ or there is no match, the route is presented as an LSA type 5 (External, E2 by default): the metric is not incremented and the preference is lower.
  • The PE sets the DN bit (Down bit) in LSA type 3/5/7 and does not accept LSAs with the DN bit from the VRF back into MP-BGP; for Type 5 a route tag is used. This protects against a loop between PEs through the customer.
  • Backdoor link: if there is a direct OSPF link (area 0) between sites, the customer will prefer it (intra-area) over the path through MPLS (inter-area). The solution is the sham-link: a virtual intra-area link between two PEs in the VRF; its endpoints are /32 loopback addresses in the VRF (not in the global table), advertised through MP-BGP but not through OSPF. The sham-link cost is chosen lower than the backdoor cost.
  • Sham-link requirements: a loopback with a /32 in the VRF, propagation of this /32 into BGP, the same area on both ends, and matching cost/hello/dead.

Timers and failure behavior

  • eBGP PE-CE: keepalive 60/hold 180 by default on Cisco, so use BFD. Without BFD a link failure stays hidden for up to 3 minutes.
  • OSPF: hello 10/dead 40 on broadcast; BFD for OSPF shortens convergence.
  • Static: without track, a blackhole until manual intervention.

Choosing a protocol

Static - simple CEs and a single prefix; eBGP - most enterprise customers and multihoming; OSPF - the customer already has an OSPF design, and the sham-link solves the backdoor problem. RIP/EIGRP are rarely used; the logic of transfer into MP-BGP is the same.

Metrics and attributes across the VPN

BGP MED/AS_PATH are preserved when passed between PEs, but inside the VRF routing the LP, MED and community are rewritten by policy. For OSPF the metric when transferred from BGP can be set explicitly (metric in redistribute), otherwise the default is used.

Architecture Diagram & Topology

text
+-----------+       PE-CE Routing Protocol Options:       +-----------+
|   CE-1    | <-----------------------------------------> |   PE-1    |
| (Customer | 1. Static Route (Simple, Low Overhead)      | (Provider |
|  Router)  | 2. eBGP (Clean AS Separation, Large Scale)  |   Edge)   |
+-----------+ 3. OSPF (Enterprise Integration, Sham-Links)| +-----------+

Traffic Flow & Label Stack Scheme