Table of Contents

Related Documents

07-Tunnel policy commands

Title	Size	Download
07-Tunnel policy commands	216.44 KB

Tunnel policy commands

binding-destination

Use binding-destination to bind tunnels to a destination IP address in a tunnel policy, so the tunnels can be used only for a specific VPN service.

Use undo binding-destination to remove the tunnel bindings for a destination IP address.

Syntax

binding-destination dest-ipv4-address { sr-policy group sr-policy-group-id | te { tunnel number }&<1-16> } [ ignore-destination-check ] [ down-switch ]

binding-destination dest-ipv6-address { srv6-policy group srv6-policy-group-id | srv6-policy { name policy-name | end-point ipv6 ipv6-address color color-value } } [ ignore-destination-check ] [ down-switch ]

undo binding-destination { dest-ipv4-address | dest-ipv6-address

Default

A tunnel policy does not bind tunnels to a destination IP address.

Views

Tunnel policy view

Predefined user roles

network-admin

Parameters

dest-ipv4-address: Specifies a destination IPv4 address.

dest-ipv6-address: Specifies a destination IPv6 address.

sr-policy group sr-policy-group-id: Specifies the SR-MPLS TE policy group to be bound with the specified destination IPv4 address. The sr-policy-group-id argument represents the ID of the SR-MPLS TE policy group, in the range of 1 to 4294967295.

te: Specifies TE tunnels for binding.

tunnel number: Specifies a tunnel to be bound with the specified destination IPv4 address. The number argument represents an existing tunnel interface number on the device.

&<1-16>: Indicates that you can bind a maximum of 16 tunnels. Traffic will be load shared among the bound tunnels.

srv6-policy group srv6-policy-group-id: Specifies the SRv6 TE policy group to be bound with the specified destination IPv6 address. The srv6-policy-group-id argument represents the ID of the SRv6 TE policy group, in the range of 1 to 4294967295.

srv6-policy: Specifies the SRv6 TE policy to be bound with the specified destination IPv6 address.

name policy-name: Specifies an SRv6 TE policy by its name, a case-sensitive string of 1 to 59 characters.

end-point ipv6 ipv6-address color color-value: Specifies an SRv6 TE policy by the destination node address and color value. The ipv6-address argument specifies the IPv6 address of the destination node. The color-value argument represents the color value, in the range of 0 to 4294967295.

ignore-destination-check: Ignores destination check. After this keyword is specified, a bound tunnel (TE tunnel, SR-MPLS TE policy group, SRv6 TE policy group, or SRv6 TE policy) can be selected even if the destination IP address of the bound tunnel is different from the destination IP address of the tunnel policy. If you do not specify this keyword, the destination address of a bound tunnel must be the same as the destination IP address of the tunnel policy.

down-switch: Enables automatic tunnel switchover within the tunnel policy when the bound tunnels (TE tunnels, SR-MPLS TE policy group tunnels, SRv6 TE policy group tunnels, or SRv6 TE policy tunnels) are not available. After this keyword is specified, the tunnel policy selects a tunnel by using the following methods in descending order of priority: tunnel binding, preferred tunnel, and load sharing. If you do not specify this keyword, the device selects tunnels only from the bound tunnels of the tunnel policy.

Usage guidelines

After a tunnel is bound to a destination IP address, traffic destined for the destination IP address will be forwarded only by the bound tunnel.

You can bind tunnels to multiple destination IP addresses in a tunnel policy.

In the same tunnel policy and for the same IPv4 destination address:

· If you execute this command multiple times to bind different types of tunnels, the most recent configuration takes effect.

· If you execute this command multiple times to bind the same type of tunnels, this command takes effect as follows:

¡ If you bind multiple MPLS TE tunnels, the MPLS TE tunnels will load share the traffic.

¡ If you bind SR-MPLS TE policy groups multiple times, the most recent configuration takes effect. That is, you can bind only one SR-MPLS TE policy group to a destination IPv4 address in a tunnel policy.

In the same tunnel policy and for the same IPv6 destination address:

· If you execute this command multiple times to bind different types of tunnels, the most recent configuration takes effect.

· If you execute this command multiple times to bind the same type of tunnels, this command takes effect as follows:

¡ If you bind multiple SRv6 TE policies, the SRv6 TE policy tunnels will load share the traffic.

¡ If you bind SRv6 TE policy groups multiple times, the most recent configuration takes effect. That is, you can bind only one SRv6 TE policy group to a destination IPv6 address in a tunnel policy.

· To change the bound SRv6 TE policy, you must first use the undo binding-destination command to delete the bound SRv6 TE policy, and then use the binding-destination command to bind a new SRv6 TE policy.

If you execute the binding-destination, preferred-path, and select-seq load-balance-number commands simultaneously for a tunnel policy, the binding-destination command has the highest priority in tunnel selection. More specifically, the tunnel policy selects tunnels as follows:

· If the destination address of a bound tunnel identifies a peer PE, the tunnel policy uses the bound tunnel to forward the traffic to the peer PE. For an SR-MPLS TE policy group, the tunnel destination address is the destination node address of the SR-MPLS TE policy group. For an SRv6 TE policy group, the tunnel destination address is the destination node address of the SRv6 TE policy group. For an SRv6 TE policy, the tunnel destination address is the destination node address of the SRv6 TE policy.

· If no bound tunnels are available for the peer PE, the tunnel policy selects a preferred tunnel whose destination address can identify the peer PE to forward traffic.

· If no preferred tunnel is available for the peer PE, the tunnel policy uses the load sharing method to forward the traffic to the peer PE.

Before binding MPLS TE tunnels to a destination IP address, first execute the mpls te reserved-for-binding command for the tunnels.

Example

# In tunnel policy policy1, bind destination address 100.1.1.9 to four TE tunnels. Ignore destination check, and allow tunnel selection using other tunnel selection methods within the tunnel policy when the binding TE tunnels are not available.

<Sysname> system-view

[Sysname] tunnel-policy policy1

[Sysname-tunnel-policy-policy1] binding-destination 100.1.1.9 te tunnel 1 tunnel 2 tunnel 3 tunnel 4 ignore-destination-check down-switch

Related commands

mpls te reserved-for-binding

preferred-path

display mpls tunnel

Use display mpls tunnel to display tunnel information.

Syntax

display mpls tunnel { all | statistics | [ vpn-instance vpn-instance-name ] destination { ipv4-address | ipv6-address } } [ slot slot-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

all: Displays all tunnels. The command displays GRE and TE tunnels only when the network layer is up.

statistics: Displays tunnel statistics.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance by its name, a case-sensitive string of 1 to 31 characters. If you do not specify a VPN instance, this command displays tunnel information for the public network.

destination: Displays the tunnel destined for the specified address.

ipv4-address: Specifies the tunnel destination IPv4 address.

ipv6-address: Specifies the tunnel destination IPv6 address.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays tunnel information on the active MPU.

Examples

# Display information about all tunnels.

<Sysname> display mpls tunnel all

Destination Type Tunnel/NHLFE VPN Instance

2.2.2.2 LSP NHLFE1024 -

3.3.3.3 CRLSP Tunnel2 -

4.4.4.4 SRPolicy NHLFE20971521 -

4.4.4.4 SRPGroup Group1 -

Table 1 Command output

Field	Description
Destination	Tunnel destination address.
Type	Tunnel type: · LSP. · GRE. · CRLSP. · SRLSP. · SRPolicy—SR-MPLS TE policy tunnel. · SRPGroup—SR-MPLS TE policy group tunnel. · FlexAlgo—Flex-Algo LSP tunnel.
Tunnel/NHLFE	Tunnel NHLFE entry, or SR-MPLS TE policy group ID. NHLFEnumber represents the ingress LSP or SR-MPLS TE policy tunnel that matches the NHLFE entry with NID of number.
VPN Instance	VPN instance name. If the tunnel belongs to the public network, this field displays a hyphen (-).

# Display tunnel statistics.

<Sysname> display mpls tunnel statistics

LSP : 1

GRE : 0

CRLSP : 0

SRLSP : 0

SRPolicy : 1

SRPGroup : 1

FlexAlgo : 0

Table 2 Command output

Field	Description
LSP	Number of LSP tunnels.
GRE	Number of GRE tunnels.
CRLSP	‌ Number of CRLSPs.
SRLSP	‌ Number of SRLSPs.
SRPolicy	‌ Number of SR-MPLS TE policy tunnels.
SRPGroup	‌ Number of SR-MPLS TE policy group tunnels.
FlexAlgo	Number of Flex-Algo LSP tunnels.

‌

display tunnel-info ipv6

Use display tunnel-info ipv6 to display information about IPv6 tunnels.

Syntax

display tunnel-info ipv6 { all | destination ipv6-address | statistics }

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

all: Display information about all IPv6 tunnels.

destination ipv6-address: Displays information about tunnels with the specified destination IPv6 address.

Statistics: Displays statistics about IPv6 tunnels.

Examples

# Display information about all IPv6 tunnels.

<Sysname> display tunnel-info ipv6 all

Destination : 222::2

Type : SRv6-TE Policy

Color : 10

Forwarding index: 2150629377

VPN instance : -

Policy name : P100

# Display statistics about IPv6 tunnels.

<Sysname> display tunnel-info ipv6 statistics

LSP : 0

GRE : 0

CRLSP : 0

SRLSP : 0

SRv6-TE Policy : 0

SRv6-TE Policy Group: 0

Table 3 Command output

Field	Description
Destination	Tunnel destination address.
Type	Tunnel type: · MPLS LDP—Tunnel established on an IPv6 LDP LSP. · SRv6-TE Policy—Tunnel established on the forwarding path selected by an SRv6 TE policy. · SRv6-TE Policy Group—Tunnel established on the forwarding path selected by an SRv6 TE policy group.
Color	Color value of the SRv6 TE policy or SRv6 TE policy group. This field is available only when the tunnel type is SRv6-TE Policy or SRv6-TE Policy Group. If the color value is invalid, this field displays a hyphen (-).
Forwarding Index	Forwarding entry index.
VPN Instance	Name of the VPN instance. For the public network, this field displays a hyphen (-).
Policy Name	SRv6 TE policy name. This field is available only when the tunnel type is SRv6-TE Policy.
Group ID	SRv6 TE policy group ID.
Group type	Type of the SRv6 TE policy group, which can be static or dynamic.
LSP	Number of LSP tunnels.
GRE	Number of GRE tunnels
CRLSP	Number of CRLSP tunnels.
SRLSP	Number of SRLSP tunnels.
SRv6-TE Policy	Number of tunnels of the SRv6 TE Policy type.
SRv6-TE Policy Group	Number of tunnels of the SRv6 TE Policy Group type.

‌

display tunnel-policy

Use display tunnel-policy to display tunnel policy information.

Syntax

display tunnel-policy [ tunnel-policy-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

tunnel-policy-name: Specifies a tunnel policy by its name, a case-sensitive string of 1 to 126 characters. If you do not specify a tunnel policy, this command displays information about all tunnel policies.

Examples

# Display information about all tunnel policies.

<Sysname> display tunnel-policy

Tunnel policy name: abc

Select-Seq: LSP, GRE, CRLSP, SRLSP, SR-TE Policy, SRv6-TE Policy, SRv6-TE Policy Group, Flex-Algo-LSP

Load balance number : 1

Strict : No

Preferred paths:

Type : TE

Tunnel: Tunnel11

Preference: 7

Type : SRv6-TE Policy(End-point/Color)

Tunnel: 4::4/20

Preference: 10

Binding-destination:

Destination IP address: 2.2.2.2

Tunnel Type : TE

Tunnels : Tunnel12

Ignore destination : No

Down switch : No

Destination IP address: 4::4

Tunnel Type : SRv6-TE Policy(Name)

Tunnels : abc

Destination IP address: 4::4

Tunnel Type : SRv6-TE Policy(End-point/Color)

Tunnels : 1000::1/10

Ignore destination : No

Down switch : No

Table 4 Command output

Field	Description
Select-Seq	Tunnel selection order. The tunnel types are displayed in descending order of priority in tunnel selection. Supported tunnel types include: · CRLSP · GRE · LSP · SRLSP · SR-TE Policy · SRv6-TE Policy · SRv6-TE Policy Group · Flex-Algo-LSP
Load balance number	Number of tunnels for load balancing.
Strict	Whether the strict method is used to select tunnels for load balancing: · No—The tunnel policy can use a hybrid of the specified types of tunnels for load balancing. · Yes—The tunnel policy uses only one type of tunnels for load balancing.
Preferred paths	Preferred tunnels information.
Type	Type of the preferred tunnel: · TE—MPLS TE tunnel. · SR-TE Policy(Name)—SR-MPLS TE policy identified by its name. · SR-TE Policy(End-point/Color)—SR-MPLS TE policy identified by the endpoint address and color value. · SRv6-TE Policy(Name)—SRv6 TE policy identified by its name. · SRv6-TE Policy(End-point/Color)—SRv6 TE policy identified by the endpoint address and color value.
Tunnel	Name of the preferred tunnel: · For an MPLS TE tunnel, this field displays the MPLS TE tunnel interface name in the format of Tunnelnumber. · For an SR-MPLS TE policy or SRv6 TE policy (endpoint/color), this field displays the endpoint address and color value of the SR-MPLS TE policy or SRv6 TE policy in the format of ip-address/color. · For an SR-MPLS TE policy or SRv6 TE policy (name), this field displays the name of the SR-MPLS TE policy or SRv6 TE policy.
Preference	Preference value of the preferred tunnel.
Binding-destination	Destination-tunnel binding information.
Destination IP address	Destination IP address for tunnel binding.
Tunnel type	Type of tunnels bound to the destination IP address: · TE—MPLS TE tunnel. · SR-TE Policy Group—SR-MPLS TE policy group tunnel. · SRv6-TE Policy Group—SRv6 TE policy group tunnel. · SRv6-TE Policy(Name)—SRv6 TE policy identified by its name. · SRv6-TE Policy(End-point/Color)—SRv6 TE policy identified by the endpoint address and color value.
Tunnels	Names of the bound tunnels: · For an MPLS TE tunnel, this field displays the MPLS TE tunnel interface name in the format of Tunnelnumber. · For an SR-MPLS TE policy group or SRv6 TE policy group, this field displays the group ID in the format of GroupID. · For an SRv6 TE policy (endpoint/color), this field displays the endpoint address and color value of the SRv6 TE policy in the format of ip-address/color. · For an SRv6 TE policy (name), this field displays the name of SRv6 TE policy.
Ignore destination	Whether to ignore the destination check. · No—Performs destination check. The destination address of a bound tunnel must be the same as the destination IP address of the tunnel policy. · Yes—Ignores the destination check. A bound tunnel can be selected even if its destination IP address is different from the destination IP address of the tunnel policy.
Down switch	Whether to enable automatic tunnel switchover within the tunnel policy when the bound tunnels are not available. · No—Not enabled. · Yes—Enabled.

‌

mpls te reserved-for-binding

Use mpls te reserved-for-binding to reserve an MPLS TE tunnel for tunnel binding in a tunnel policy.

Use undo mpls te reserved-for-binding to restore the default.

Syntax

mpls te reserved-for-binding

undo mpls te reserved-for-binding

Default

An MPLS TE tunnel can be used by any tunnel policy implementation methods.

Views

Tunnel interface view

Predefined user roles

network-admin

Usage guidelines

If a VPN has high requirements on bandwidth, you can select TE tunnels for the VPN by applying a tunnel policy bound with TE tunnels to the VPN.

You must execute this command for an MPLS TE tunnel before the tunnel can be bound to a destination address in a tunnel policy.

After you execute this command for an MPLS TE tunnel, the tunnel can only be used as a bound tunnel of a tunnel policy. For more information about tunnel binding, see the binding-destination command.

Examples

# Reserve an MPLS TE tunnel for tunnel binding in a tunnel policy.

<Sysname> system-view

[Sysname] interface tunnel 10 mode mpls-te

[Sysname-Tunnel10] mpls te reserved-for-binding

Related commands

binding-destination

preferred-path

Use preferred-path to configure a preferred tunnel.

Use undo preferred-path to remove a preferred tunnel.

Syntax

preferred-path { sr-policy { name sr-policy-name | end-point ipv4 ipv4-address color color-value } | srv6-policy { name srv6-policy-name | end-point ipv6 ipv6-address color color-value } | tunnel number | [ preference value ]

undo preferred-path { sr-policy { name sr-policy-name | end-point ipv4 ipv6-address color color-value } | srv6-policy { name srv6-policy-name | end-point ipv6 ipv6-address color color-value } | tunnel number | [ preference value ]

Default

No preferred tunnels are configured.

Views

Tunnel policy view

Predefined user roles

network-admin

Parameters

sr-policy: Specifies an SR-MPLS TE policy as the preferred tunnel.

name sr-policy-name: Specifies an SR-MPLS TE policy by its name, a case-sensitive string of 1 to 59 characters.

end-point ipv4 ipv4-address color color-value: Specifies an SR-MPLS TE policy by the destination node address and color value. The ipv4-address argument specifies the IPv4 address of the destination node. The color-value argument represents the color value, in the range of 0 to 4294967295.

srv6-policy: Specifies an SRv6 TE policy as the preferred tunnel.

name srv6-policy-name: Specifies an SRv6 TE policy by its name, a case-sensitive string of 1 to 59 characters.

tunnel number: Specifies an MPLS TE tunnel or a GRE tunnel by its tunnel interface number. The value range for the number argument is 0 to 32767.

preference value: Specifies the preference value of the preferred tunnel, in the range of 0 to 65534. A smaller value represents a higher preference. If you do not specify this keyword, the system automatically calculates the preference value, which is the largest preference value existing in the current tunnel policy plus 100. If the preferred tunnel you are configuring is the first preferred in the current tunnel policy, the preference value for this preferred tunnel is 100 by default.

Usage guidelines

Operating mechanism

You can configure an SR-MPLS TE policy, SRv6 TE policy, MPLS TE tunnel, or a GRE tunnel as a preferred tunnel of a tunnel policy.

As a best practice for an MPLS VPN, configure a preferred tunnel and make sure the destination address of the preferred tunnel identifies the peer PE. In this method, the local PE forwards traffic destined for the peer PE over the preferred tunnel.

For a tunnel policy to solely use a tunnel, an SR-MPLS TE policy tunnel, or an SRv6 TE policy tunnel, do not configure the tunnel as the preferred tunnel in other tunnel policies.

If you configure multiple preferred tunnels that have the same destination address in a tunnel policy, the system selects the preferred tunnel with the highest preference. If that tunnel is not available, the tunnel with second highest preference is used, and so forth. No load sharing will be performed on these tunnels.

When you configure preferences for preferred tunnels, follow these restrictions and guidelines:

· You cannot assign the same preference value to different tunnels in the same tunnel policy.

· If the largest preference value existing in a tunnel policy equals to or greater than 65435, you must specify the preference value when you configure a new preferred tunnel in the tunnel policy. If you do not dot specify the preference value, the preferred tunnel cannot be configured.

· If no bound tunnels are available for the peer PE, the tunnel policy selects a preferred tunnel whose destination address can identify the peer PE to forward traffic.

· If no preferred tunnel is available for the peer PE, the tunnel policy uses the load sharing method to forward the traffic to the peer PE.

Restrictions and guidelines

In SR-MPLS TE policy or SRv6 TE policy networks, if routes carry the color extended community attribute or you have specify a color value by using the default-color command, the preferred tunnel specified in a tunnel policy does not take effect. The device selects proper tunnels for packets according to the color attribute and the tunnel selection order specified by the select-seq command.

Examples

# Configure tunnel 1 and tunnel 2 as preferred tunnels for tunnel policy policy1.

<Sysname> system-view

[Sysname] tunnel-policy policy1

[Sysname-tunnel-policy-policy1] preferred-path tunnel 1

[Sysname-tunnel-policy-policy1] preferred-path tunnel 2

select-seq load-balance-number

Use select-seq load-balance-number to configure the tunnel selection order and set the number of tunnels for load sharing.

Use undo select-seq to restore the default.

Syntax

select-seq [ strict ] { cr-lsp | flex-algo-lsp | gre | lsp | sr-lsp | sr-policy | srv6-policy | srv6-policy-group } * load-balance-number number

undo select-seq

Default

The device selects only one tunnel in LSP, GRE, CRLSP, SRLSP, SR-MPLS TE policy, SRv6 TE policy, SRv6 TE policy group, and Flex-Algo LSP order.

Views

Tunnel policy view

Predefined user roles

network-admin

Parameters

strict: Uses the same type of tunnels for load balancing.

· If you specify this keyword, VPN uses only one type of tunnels for load balancing. For example, if the select-seq strict lsp cr-lsp load-balance-number 3 command is used, VPN uses only one type of tunnels. If LSP tunnels are available, VPN uses only LSP tunnels. If no LSP tunnels are available, VPN uses only CRLSP tunnels.

· If you do not specify this keyword, VPN can use a hybrid of the specified types of tunnels for load balancing. For example, if the select-seq lsp cr-lsp load-balance-number 3 command is used, VPN preferentially uses LSP tunnels for load balancing. If the number of LSP tunnels is zero or less than three, VPN uses CRLSP tunnels to remedy the deficiency of LSP tunnels.

· SR-MPLS TE policy tunnels, SRv6 TE policy tunnels, SRv6 TE policy group tunnels, and Flex-Algo LSP tunnels cannot share load with other types of tunnels regardless of whether you have specified this keyword or not.

cr-lsp: Uses CRLSP tunnels.

flex-algo-lsp: Uses LSP tunnels calculated by Flex-Algos.

gre: Uses GRE tunnels.

lsp: Uses LSP tunnels.

sr-lsp: Uses SRLSP tunnels.

sr-policy: Uses SR-MPLS TE policy tunnels.

srv6-policy: Uses SRv6 TE policy tunnels.

srv6-policy-group: Uses SRv6 TE policy group tunnels.

load-balance-number number: Specifies the number of tunnels for load sharing. The value range is 1 to 128.

Usage guidelines

A tunnel type closer to the select-seq keyword has a higher priority.

Tunnels selected by this method are not fixed, making it hard to plan VPN traffic. As a best practice, do not use this method.

Only one SRv6 TE policy group can be selected, using the following rules:

1. A dynamically created SRv6 TE policy group has a higher priority than a statically configured SRv6 TE policy group.

2. An SRv6 TE policy group with a smaller color value has a higher priority.

3. An SRv6 TE policy group with a smaller group ID has a higher priority.

· If no bound tunnels are available for the peer PE, the tunnel policy selects a preferred tunnel whose destination address can identify the peer PE to forward traffic.

· If no preferred tunnel is available for the peer PE, the tunnel policy uses the load sharing method to forward the traffic to the peer PE.

Examples

# Configure tunnel policy policy1 to use only CRLSP tunnels, and set the load sharing number to 2.

<Sysname> system-view

[Sysname] tunnel-policy policy1

[Sysname-tunnel-policy-policy1] select-seq cr-lsp load-balance-number 2

Related commands

binding-destination

preferred-path

tunnel-policy (system view)

Use tunnel-policy to create a tunnel policy and enter its view, or enter the view of an existing tunnel policy.

Use undo tunnel-policy to delete a tunnel policy.

Syntax

tunnel-policy tunnel-policy-name [ default ]

undo tunnel-policy tunnel-policy-name

Default

No tunnel policies exist.

Views

System view

Predefined user roles

network-admin

Parameters

tunnel-policy-name: Specifies a name for the tunnel policy, a case-sensitive string of 1 to 126 characters.

default: Uses the policy as the global tunnel policy.

Usage guidelines

The device supports only one global tunnel policy.

An MPLS VPN uses the global tunnel policy if it is not bound with a specific tunnel policy or the bound policy does not exist. If the bound policy exists but is null, the MPLS VPN selects tunnels in the default tunnel selection orderthe tunnel selection order is LSP, GRE, CRLSP, SRLSP, SR-MPLS TE policy, SRv6 TE policy, SRv6 TE policy group, and Flex-Algo LSP, and the number of tunnels selected for load balancing is 1.

Examples

# Create tunnel policy policy1 and enter its view.

<Sysname> system-view

[Sysname] tunnel-policy policy1

[Sysname-tunnel-policy-policy1]

Tunnel selector commands

apply tunnel-policy

Use apply tunnel-policy to specify a tunnel policy for a tunnel selector.

Use undo apply tunnel-policy to restore the default.

Syntax

apply tunnel-policy tunnel-policy-name

undo apply tunnel-policy

Default

No tunnel policy is specified for a tunnel selector.

Views

Tunnel selector view

Predefined user roles

network-admin

Parameters

tunnel-policy-name: Specifies a tunnel policy by its name, a case-sensitive string of 1 to 126 characters.

Usage guidelines

If you specify a nonexistent tunnel policy for a tunnel selector, use the tunnel-policy command to create the policy and then configure the policy.

Examples

# Specify tunnel policy policy1 for tunnel selector ts1.

<Sysname> system-view

[Sysname] tunnel-policy policy1

[Sysname-tunnel-policy-policy1] select-seq cr-lsp lsp load-balance-number 1

[Sysname-tunnel-policy-policy1] quit

[Sysname] tunnel-selector ts1 permit node 10

[Sysname-tunnel-selector-ts1-10] if-match rd-list 1

[Sysname-tunnel-selector-ts1-10] apply tunnel-policy policy1

Related commands

display tunnel-selector

tunnel-policy

tunnel-selector

apply tunnel-selector

Use apply tunnel-selector to apply a tunnel selector to BGP EVPN routes, BGP VPNv4 routes, BGP VPNv6 routes, or labeled BGP IPv4 or IPv6 unicast routes.

Use undo apply tunnel-selector to cancel the application.

Syntax

In BGP IPv4 unicast address family view/BGP-VPN IPv4 unicast address family view/BGP IPv6 unicast address family view/BGP-VPN IPv6 unicast address family view/BGP EVPN address family view:

apply tunnel-selector tunnel-selector-name [ all ]

undo apply tunnel-selector

In BGP VPNv4 address family view/BGP VPNv6 address family view:

apply tunnel-selector tunnel-selector-name

undo apply tunnel-selector

Default

No tunnel selector is applied to BGP VPNv4 routes, BGP VPNv6 routes, or labeled BGP IPv4 or IPv6 unicast routes.

Views

BGP IPv4 unicast address family view

BGP-VPN IPv4 unicast address family view

BGP VPNv4 address family view

BGP IPv6 unicast address family view

BGP-VPN IPv6 unicast address family view

BGP VPNv6 address family view

BGP EVPN address family view

Predefined user roles

network-admin

Parameters

tunnel-selector-name: Specifies a tunnel selector by its name, a case-sensitive string of 1 to 40 characters.

all: Applies the tunnel selector to all BGP unicast routes, including labeled routes and subnet routes. This keyword is not available in BGP VPNv4 or BGP VPNv6 address family view.

Usage guidelines

This command can perform route recursion for BGP EVPN, BGP VPNv4, BGP VPNv6, or labeled BGP IPv4 or IPv6 unicast routes to select expected types of tunnels.

This command is mainly applicable to the following BGP/MPLS L3VPN scenarios:

· In an inter-AS Option B network, an ASBR is not configured with VPN instances but it needs to apply a tunnel policy to the BGP VPNv4 or BGP VPNv6 routes received from the PEs.

· In an HoVPN, an SPE needs to apply a tunnel policy to the BGP VPNv4 or VPNv6 routes received from UPEs.

· In an inter-AS Option C network, the local PE needs to apply a tunnel policy to the BGP labeled routes advertised to the remote PEs.

In an inter-AS Option C network, to perform tunnel load balancing for BGP labeled routes, execute the apply tunnel-selector tunnel-selector-name all command on the ASBR.

Deleting the applied tunnel selector might cause VPN service interruption because the routes cannot recurse to tunnels.

Examples

# In BGP IPv4 unicast address family view, apply tunnel selector ts1 to BGP labeled routes.

<Sysname> system-view

[Sysname] bgp 100

[Sysname-bgp-default] address-family ipv4 unicast

[Sysname-bgp-default-ipv4] apply tunnel-selector ts1

Related commands

tunnel-selector

display ip rd-list

Use display ip rd-list to display RD list information.

Syntax

display ip rd-list [ rd-list-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

rd-list-number: Specifies an RD list by its number, in the range of 1 to 65535. If you do not specify an RD list, this command display information about all RD lists.

Examples

# Display information about all RD lists.

<Sysname> display ip rd-list

Route Distinguisher List Number 1

Index: 1 permit 1.1.1.1:1 2.2.2.2:* 100:1 200:*

Route Distinguisher List Number 2

Index: 2 deny 1:1 2:2

Table 5 Command output

Field	Description
Route Distinguisher List Number	RD list number.
Index	Index of an RD list item.
permit	Match mode of the RD list item: · Permit. · Deny.

Related commands

ip rd-list

display tunnel-selector

Use display tunnel-selector to display tunnel selector information.

Syntax

display tunnel-selector [ tunnel-selector-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

tunnel-selector-name: Specifies a tunnel selector by its name, a case-sensitive string of 1 to 40 characters. If you do not specify a tunnel selector, this command displays information about all tunnel selectors.

Examples

# Display information about all tunnel selectors.

<Sysname> display tunnel-selector

Tunnel-selector: ts1

Permit : 1

if-match ip next-hop prefix-list ipv4prefix1

apply tunnel-policy policy1

Tunnel-selector: ts2

Permit : 2

if-match ip address acl 2222

if-match ip rd-list 2

apply tunnel-policy policy2

Table 6 Command output

Field	Description
Tunnel-selector	Tunnel selector name.
Permit	Node match mode and node number of the tunnel selector. The node match mode can be Permit or Deny.
if-match	Match criterion configured by the if-match clause.
apply	The action to be applied to the matching routes.

Related commands

tunnel-selector

if-match community

Use if-match community to configure a community list match criterion for BGP routes

Use undo if-match community to delete a community list match criterion for BGP routes.

Syntax

if-match community { { basic-community-list-number | name comm-list-name } [ whole-match ] | adv-community-list-number }&<1-32>

undo if-match community [ { basic-community-list-number | name comm-list-name } [ whole-match ] | adv-community-list-number ]&<1-32>

Default

No BGP community list match criterion is configured.

Views

Tunnel selector view

Predefined user roles

network-admin

Parameters

basic-community-list-number: Specifies a basic community list by its number, in the range of 1 to 99.

adv-community-list-number: Specifies an advanced community list by its number, in the range of 100 to 199.

name comm-list-name: Specifies a community list by its name, a case-sensitive string of 1 to 63 characters that cannot contain only numbers.

whole-match: Exactly matches the specified community list. All of the specified communities and only those communities must be present.

&<1-32>: Indicates that you can specify a maximum of 32 community lists.

Usage guidelines

If the specified community list number or name does not exist, use the ip community-list command to create it.

The whole-match keyword takes effect only on the community list specified in front of this keyword. If you specify multiple community lists and require exact match for each community list, add this keyword after each filter. This keyword takes effect only on basic community lists.

Examples

# Configure community list 1 to permit BGP routes with community number 100 or 200. Then configure node 10 in permit mode for tunnel selector ts1 to use community list 1 to match BGP routes.

<Sysname> system-view

[Sysname] ip community-list 1 permit 100 200

[Sysname] tunnel-selector ts1 permit node 10

[Sysname-tunnel-selector-ts1-10] if-match community 1

Related commands

ip community-list (Layer 3—IP Routing Command Reference)

if-match extcommunity

Use if-match extcommunity to configure an extended community list match criterion for BGP routes

Use undo if-match extcommunity to delete an extended community list match criterion for BGP routes.

Syntax

if-match extcommunity { ext-comm-list-number | ext-comm-list-name }&<1-32>

undo if-match extcommunity [ ext-comm-list-number | ext-comm-list-name ]&<1-32>

Default

No BGP extended community list match criterion is configured.

Views

Tunnel selector view

Predefined user roles

network-admin

Parameters

ext-comm-list-number: Specifies an extended community list by its number, in the range of 1 to 65535.

ext-comm-list-name: Specifies an extended community list by its name, a case-sensitive string of 1 to 63 characters that cannot contain only numbers.

&<1-32>: Indicates that you can specify a maximum of 32 extended community lists.

Usage guidelines

If the extended community list specified for a match criterion does not exist, the criterion matches all BGP routes.

Examples

# Configure extended community lists 100 and 150 to permit BGP routes with RT 100:100 and RT 150:150, respectively. Then configure node 10 in permit mode for tunnel selector ts1 to use community list 100 and 150 to match BGP routes.

<Sysname> system-view

[Sysname] ip extcommunity-list 100 permit rt 100:100

[Sysname] ip extcommunity-list 150 permit rt 150:150

[Sysname] tunnel-selector ts1 permit node 10

[Sysname-tunnel-selector-ts1-10] if-match extcommunity 100 150

Related commands

ip extcommunity-list (Layer 3—IP Routing Command Reference)

if-match ip

Use if-match ip to configure an IPv4 route match criterion.

Use undo if-match ip to delete the specified IPv4 route match criterion.

Syntax

if-match ip { address | next-hop } { acl ipv4-acl-number | prefix-list prefix-list-name }

undo if-match ip { address | next-hop } [ acl | prefix-list ]

Default

No IPv4 route match criterion is configured.

Views

Tunnel selector view

Predefined user roles

network-admin

Parameters

address: Matches the destination address of IPv4 routes.

next-hop: Matches the next hop of IPv4 routes.

acl ipv4-acl-number: Specifies an ACL by its number. The value range for the ipv4-acl-number argument is 2000 to 3999 for the address keyword, and 2000 to 2999 for the next-hop keyword.

prefix-list prefix-list-name: Specifies an IP prefix list by its name, a case-sensitive string of 1 to 63 characters.

Usage guidelines

If the specified ACL or IP prefix list does not exist, use the acl command or the ip prefix-list command to create it.

If the specified ACL does not exist or no rules exist in the ACL, the ACL does not take effect in IPv4 route matching.

If the specified ACL contains a rule with the vpn-instance keyword, the ACL rule does not take effect in IPv4 route matching.

Examples

# Create a tunnel selector named ts1, and configure node 10 for the tunnel selector to permit IPv4 routes whose next hop matches IP prefix list p1.

<Sysname> system-view

[Sysname] tunnel-selector ts1 permit node 10

[Sysname-tunnel-selector-ts1-10] if-match ip next-hop prefix-list p1

Related commands

acl (ACL and QoS Command Reference)

ip prefix-list (Layer 3—IP Routing Command Reference)

if-match ipv6

Use if-match ipv6 to configure an IPv6 route match criterion.

Use undo if-match ipv6 to delete the specified IPv6 route match criterion.

Syntax

if-match ipv6 { address | next-hop } { acl ipv6-acl-number | prefix-list prefix-list-name }

undo if-match ipv6 { address | next-hop } [ acl | prefix-list ]

Default

No IPv6 route match criterion is configured.

Views

Tunnel selector view

Predefined user roles

network-admin

Parameters

address: Matches the destination address of IPv6 routes.

next-hop: Matches the next hop of IPv6 routes.

acl ipv6-acl-number: Specifies an IPv6 ACL by its number. The value range for the ipv6-acl-number argument is 2000 to 3999 for the address keyword, and 2000 to 2999 for the next-hop keyword.

prefix-list prefix-list-name: Specifies an IPv6 prefix list by its name, a case-sensitive string of 1 to 63 characters.

Usage guidelines

If the specified IPv6 ACL or IPv6 prefix list does not exist, use the acl command or the ipv6 prefix-list command to create it.

If the specified ACL does not exist or no rules exist in the ACL, the ACL does not take effect in IPv6 route matching.

If the specified ACL contains a rule with the vpn-instance keyword, the ACL rule does not take effect in IPv6 route matching.

Examples

# Create a tunnel selector named ts1, and configure node 10 for the tunnel selector to permit IPv6 routes whose next hop matches IPv6 prefix list p1.

<Sysname> system-view

[Sysname] tunnel-selector ts1 permit node 10

[Sysname-tunnel-selector-ts1-10] if-match ipv6 next-hop prefix-list p1

Related commands

acl (ACL and QoS Command Reference)

ipv6 prefix-list (Layer 3—IP Routing Command Reference)

if-match large-community

Use if-match large-community to configure a Large Community attribute match criterion for BGP routes.

Use undo if-match large-community to delete a Large Community attribute match criterion for BGP routes.

Syntax

if-match large-community { { basic-large-comm-list-number | name large-comm-list-name } [ whole-match ] | adv-large-comm-list-number }&<1-32>

undo if-match large-community [ { basic-large-comm-list-number | name large-comm-list-name } [ whole-match ] | adv-large-comm-list-number ]&<1-32>

Default

No BGP Large Community attribute match criterion is configured.

Views

Tunnel selector view

Predefined user roles

network-admin

Parameters

basic-large-comm-list-number: Specifies a basic Large Community list by its number, in the range of 1 to 99.

name large-comm-list-name: Specifies a Large Community list by its name, a case-sensitive string of 1 to 63 characters that cannot contain only numbers.

whole-match: Exactly matches the specified community list. All of the specified communities and only those communities must be present. If you do not specify this keyword, a route matches the criterion only if the Large Community list of the route contains all of the specified communities in the criterion.

adv-large-comm-list-number: Specifies an advanced Large Community list by its number, in the range of 100 to 199.

&<1-32>: Indicates that you can specify a maximum of 32 Large Community lists.

Usage guidelines

If the specified Large Community list number or name does not exist, use the ip large-community-list command to create it.

The whole-match keyword takes effect only on the Large Community list specified in front of this keyword. If you specify multiple Large Community lists and require exact match for each of them, add this keyword after each filter. This keyword takes effect only on basic Large Community lists.

Examples

# Configure Large Community list 1 to permit BGP routes with large communities 1:1:1 or 1:1:2. Configure node 10 in permit mode for tunnel selector ts1 to use Large Community list 1 to match BGP routes.

<Sysname> system-view

[Sysname] ip large-community-list 1 permit 1:1:1 1:1:2

[Sysname] tunnel-selector ts1 permit node 10

[Sysname-tunnel-selector-ts1-10] if-match large-community 1

Related commands

ip large-community-list (Layer 3—IP Routing Command Reference)

if-match rd-list

Use if-match rd-list to configure an RD list match criterion for BGP routes.

Use undo if-match rd-list to delete the RD list match criterion.

Syntax

if-match rd-list rd-list-number

undo if-match rd-list

Default

No RD list match criterion is configured for BGP routes.

Views

Tunnel selector view

Predefined user roles

network-admin

Parameters

rd-list-number: Specifies an RD list by its number, in the range of 1 to 65535.

Usage guidelines

When you configure an RD list match criterion for BGP route filtering, the following applies:

· If the specified RD list is not configured (by using the ip rd-list command), routes are permitted by the RD list.

· If the RD list is well configured but a route does not match any RD specified in the list, the route is denied by the RD list.

· The relation between the RDs specified in an RD list are logical OR in route matching, because each route has only one RD.

Examples

# Configure RD list 1 to permit BGP routes with RD 1:1. Create tunnel selector ts1, and configure node 10 for the tunnel selector to permit BGP routes that match RD list 1.

<Sysname> system-view

[Sysname] ip rd-list 1 permit 1:1

[Sysname] tunnel-selector ts1 permit node 10

[Sysname-tunnel-selector-ts1-10] if-match rd-list 1

Related commands

ip rd-list

Use ip rd-list to configure an RD list.

Use undo ip rd-list to delete an RD list.

Syntax

ip rd-list rd-list-number [ index index-number ] { deny | permit } route-distinguisher&<1-10>

undo ip rd-list rd-list-number [ index index-number ] [ { deny | permit } route-distinguisher&<1-10> ]

Default

No RD lists exist.

Views

System view

Predefined user roles

network-admin

Parameters

rd-list-number: Specifies the RD list number, in the range of 1 to 65535.

index index-number: Specifies the index number for an RD list item. The value range for the index-number argument is 1 to 4294967295. An item with a smaller index number is matched first. If you do not specify this option, the system automatically assigns index numbers starting from 10 and in steps of 10. If the maximum value has been assigned, the system assigns index numbers from the available values, in ascending order.

deny: Sets the match mode of the RD list to deny.

permit: Sets the match mode of the RD list to permit.

route-distinguisher&<1-10>: Specifies up to 10 RDs. An RD is a string of 3 to 21 characters, and can be configured in one of the following formats:

· 16-bit AS number:32-bit user-defined number. For example, 101:3.

· 16-bit AS number:wildcard. For example, 101:*.

· 32-bit IPv4 address:16-bit user-defined number. For example, 192.168.122.15:1.

· 32-bit IPv4 address:wildcard. For example, 192.168.122.15:*.

· 32-bit AS number:16-bit user-defined number, where the minimum value of the AS number is 65536. For example, 65536:1.

· 32-bit AS number:wildcard, where the minimum value of the AS number is 65536. For example, 65536:*.

Usage guidelines

After you configure RD lists by using the ip rd-list command, you can implement BGP route filtering by using a tunnel selector as follows:

1. Use the if-match rd-list command to specify a created RD list to configure an RD list match criterion in tunnel selector view.

2. Applies the tunnel selector to BGP routes.

If an RD list is used for route filtering, the following applies:

· If the RD list is not configured, routes are permitted by the RD list.

· If the RD list is well configured but a route does not match any RD specified in the list, the route is denied by the RD list.

· The relation between the RDs specified in an RD list are logical OR in route matching, because each route has only one RD.

Examples

# Create RD list 1 to permit routes with RD 100:1.

<Sysname> system-view

[Sysname] ip rd-list 1 permit 100:1

Related commands

· display ip rd-list

· if-match rd-list

tunnel-selector

Use tunnel-selector to create a tunnel selector and enter its view, or enter the view of an existing tunnel selector.

Use undo tunnel-selector to delete a tunnel selector.

Syntax

tunnel-selector tunnel-selector-name { deny | permit } node node-number

undo tunnel-selector tunnel-selector-name { deny | permit } node node-number

Default

No tunnel selectors exist.

Views

System view

Predefined user roles

network-admin

Parameters

tunnel-selector-name: Specifies the tunnel selector name, a case-sensitive string of 1 to 40 characters.

deny: Sets the match mode of the tunnel selector to deny. If a route matches all the if-match clauses of a node, the route is denied and does not match the next node. If a route does not match an if-match clause of a node, the route continues to match the next node.

permit: Sets the match mode of the tunnel selector to permit. If a route matches all the if-match clauses of a node, the route matches the node. If a route does not match an if-match clause of a node, the route continues to match the next node.

node node-number: Specifies a node number for the tunnel selector. The value range for node-number argument is 0 to 65535. The node with a smaller node number is matched first.

Usage guidelines

A tunnel selector is needed in the following BGP/MPLS L3VPN scenarios:

· In an inter-AS Option B network, an ASBR is not configured with VPN instances but it needs to apply a tunnel policy to the BGP VPNv4 or BGP VPNv6 routes received from the PEs.

· In an inter-AS Option C network, the local PE needs to apply a tunnel policy to the BGP labeled routes advertised to the remote PEs.

Examples

# Create a tunnel selector and enter its view. Specify the tunnel selector name as ts1, node number as 10, and match mode as permit.

<Sysname> system-view

[Sysname] tunnel-selector ts1 permit node 10

[Sysname-tunnel-selector-ts1-10]

Related commands

display tunnel-selector

09-MPLS Command Reference

Operating mechanism

Restrictions and guidelines

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Policy & Program

Global Learning

Partner Sales Resources

Service Business

News & Events

Contact Us