How to configure Hub and Spoke in “Spoke to Hub Only” Setup : Versa Support

This article discusses Hub and Spoke in Spoke to Hub Only configuration via Versa Director GUI. Hub and Spoke Topology (Link Here) is referred in doing the Hub and Spoke configuration. Workflow Template is used to Stage FlexVNF with few specific knobs required based on if device is HUB or SPOKE. In Spoke to Hub Only there is no communication between spoke to spoke either directly or through a hub. This type of configuration is preferred when hub is used as a gateway to go out from spoke site.

Prerequisite: Versa director and Controller setup is already done. Should be aware of Workflow Template and Branch On boarding.

Configuring Hub1 Template

To configure the HUB:

In the Versa Director, Select Configuration > Workflow>Templates > Create Template. Fill the required information and make sure (Key Value) Device type should be HUB

Interfaces> Assign WAN /LAN interface(LAN-VR is required for hub to be next hop for Spoke’s for network behind hub)

If default route is also required from hub as central break out we can configure split tunnelling, but this will also make the setup behave as Spoke to Spoke via Hub due to default route.

Split Tunnels> Select the LAN-VR in VRF and WAN interface. Select Gateway to have default route in LAN-VR to WAN , Select DIA in place of Gateway if NAT is required. Continue and Create Template.

Follow Workflow Template to created Device Configuration > Workflow>Devices> + Add Device and Device Group for HUB staging

=> Before configuring spoke group Hub should be deployed and ZTP should be completed.

Configuring Spoke Group

To configure the Spoke Group:

Create Spoke-Group that will group Spoke1, Spoke 2, Select Configuration > Workflow>Spoke Groups > select + Add. We selected (Key Value) Spoke Group type as Spoke to Hub Only. Set HUB priority to 1. In the multiple hub case, you can give different priorities to make one hub preferred over other for traffic forwarding to or via it.

cid:image015.png@01D49215.A918CB90

Configuring Spoke1 and Spoke2 Template

To configure the Spoke:

Create template for Spoke Configuration > Workflow>Templates > Create Template and fill the required information, make sure (Key Value) Device type should be Spoke, select Spoke-Group from drop down

Interfaces> Assign WAN and LAN interfaces, click Continue and Create Template. cid:image013.jpg@01D48C89.38858670

Follow work flow template to created Device Configuration > Workflow>Devices> + Add Device and Device Group for Spoke staging. Follow the same steps to create Spoke2. Spoke Group will same as S2SviaHUB1

Check HUB and Spoke status post staging. Administration > Appliances cid:image015.jpg@01D48C89.38858670

Validation

@HUB:

“LAN-VR” on hub will have routes for network behind spoke's, a default route to WAN-VR and connected routes for network behind hub. In WAN-VR reverse route for spoke subnet will be there.

admin@HUB1-cli> show route routing-instance DUN-SubOrg-LAN-VR

Prot   Type  Dest Address/Mask   Next-hop        Age      Interface name

----   ----  -----------------   --------        ---      --------------

BGP    N/A  +0.0.0.0/0           169.254.0.2     00:14:13 tvi-0/603.0

conn   N/A  +169.254.0.2/31      0.0.0.0         00:14:16 tvi-0/603.0

local  N/A  +169.254.0.3/32      0.0.0.0         00:14:16 directly connected

conn   N/A  +192.168.56.0/24     0.0.0.0         00:16:00 vni-0/2.0

local  N/A  +192.168.56.1/32     0.0.0.0         00:16:00 directly connected

BGP    N/A  +192.168.77.0/24     10.4.64.103     00:16:03 Indirect

BGP    N/A  +192.168.88.0/24     10.4.64.105     00:16:03 Indirect


 

admin@HUB1-cli> show route routing-instance INT-Transport-VR

Prot   Type  Dest Address/Mask   Next-hop        Age      Interface name

----   ----  -----------------   --------        ---      --------------

static N/A  +0.0.0.0/0           192.168.50.2    6d06h35m vni-0/0.0

conn   N/A  +169.254.0.2/31      0.0.0.0         00:14:44 tvi-0/602.0

local  N/A  +169.254.0.2/32      0.0.0.0         00:14:44 directly connected

conn   N/A  +192.168.50.0/24     0.0.0.0         6d06h35m vni-0/0.0

local  N/A  +192.168.50.10/32    0.0.0.0         6d06h35m directly connected

BGP    N/A  +192.168.56.0/24     169.254.0.3     00:14:41 tvi-0/602.0

BGP    N/A  +192.168.77.0/24     169.254.0.3     00:14:41 tvi-0/602.0

BGP    N/A  +192.168.88.0/24     169.254.0.3     00:14:41 tvi-0/602.0

admin@HUB1-cli> show interfaces brief 169.254.0.2          

ptvi17       n/a                up     up     2       DUN-SubOrg-Control-VR  10.4.64.2/32           

tvi-0/17.0   n/a                up     up     2       DUN-SubOrg-Control-VR  10.4.64.104/32    

tvi-0/602.0  n/a                up     up     2       INT-Transport-VR       169.254.0.2/31    

tvi-0/603.0  n/a                up     up     2       DUN-SubOrg-LAN-VR      169.254.0.3/31

@SPOKE1:

Spoke1 will have routes for network behind hub and a default route to hub tvi-0/17 (.104). No route for Spoke2 subnets

admin@SPOKE1-cli> show route routing-instance DUN-SubOrg-LAN-VR

Prot   Type  Dest Address/Mask   Next-hop        Age      Interface name

----   ----  -----------------   --------        ---      --------------

BGP    N/A  +0.0.0.0/0           10.4.64.104     00:16:29 Indirect

BGP    N/A  +192.168.56.0/24     10.4.64.104     00:18:17 Indirect

conn   N/A  +192.168.77.0/24     0.0.0.0         6d08h47m vni-0/2.0

local  N/A  +192.168.77.1/32     0.0.0.0         6d08h47m directly connected

admin@SPOKE1-cli> show interfaces brief

ptvi17      n/a                up     up     2       DUN-SubOrg-Control-VR  10.4.64.2/32

tvi-0/17.0  n/a                up     up     2       DUN-SubOrg-Control-VR  10.4.64.103/32

@SPOKE2:

Similarly Spoke2 will have routes for network behind hub and default route to hub tvi-0/17 (.104). No route for Spoke1 subnets

admin@SPOKE2-cli> show route routing-instance DUN-SubOrg-LAN-VR

Prot   Type  Dest Address/Mask   Next-hop        Age      Interface name

----   ----  -----------------   --------        ---      --------------

BGP    N/A  +0.0.0.0/0           10.4.64.104     00:16:52 Indirect

BGP    N/A  +192.168.56.0/24     10.4.64.104     00:18:40 Indirect

conn   N/A  +192.168.88.0/24     0.0.0.0         6d06h40m vni-0/2.0

local  N/A  +192.168.88.1/32     0.0.0.0         6d06h40m directly connected

admin@SPOKE2-cli> show interfaces brief

ptvi17      n/a                up     up     2       DUN-SubOrg-Control-VR  10.4.64.2/32

tvi-0/17.0  n/a                up     up     2       DUN-SubOrg-Control-VR  10.4.64.105/32

CLI Configuration

@HUB

set interfaces tvi-0/602 description "WAN side Split Tunnel interface between INT and DUN-SubOrg-LAN-VR"

set interfaces tvi-0/602 enable true

set interfaces tvi-0/602 type paired

set interfaces tvi-0/602 paired-interface tvi-0/603

set interfaces tvi-0/602 unit 0 enable true

set interfaces tvi-0/602 unit 0 family

set interfaces tvi-0/602 unit 0 family inet

set interfaces tvi-0/602 unit 0 family inet address 169.254.0.2/31

set interfaces tvi-0/603 description "LAN side Split Tunnel Interface between INT and DUN-SubOrg-LAN-VR"

set interfaces tvi-0/603 enable true

set interfaces tvi-0/603 type paired

set interfaces tvi-0/603 paired-interface tvi-0/602

set interfaces tvi-0/603 unit 0 enable true

set interfaces tvi-0/603 unit 0 family

set interfaces tvi-0/603 unit 0 family inet

set interfaces tvi-0/603 unit 0 family inet address 169.254.0.3/31

set routing-instances DUN-SubOrg-Control-VR instance-type virtual-router

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term Paired-TVI-Reject match address 169.254.0.0/16

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term Paired-TVI-Reject action reject

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term SDWAN-TVI2-Reject match address 10.4.64.104/32

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term SDWAN-TVI2-Reject action reject

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term DIRECT match protocol direct

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term DIRECT action accept

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term DIRECT action set-origin igp

set routing-instances DUN-SubOrg-Control-VR policy-options redistribute-to-bgp Control-VR-Policy

set routing-instances DUN-SubOrg-Control-VR mpls-vpn-core

set routing-instances DUN-SubOrg-Control-VR interfaces [ ptvi17 tvi-0/17.0 ]

set routing-instances DUN-SubOrg-Control-VR routing-options mpls-vpn-local-router-interface family inet

set routing-instances DUN-SubOrg-Control-VR routing-options mpls-vpn-local-router-interface interface tvi-0/17.0

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 local-address 10.4.64.104

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart enable

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart maximum-restart-time 3600

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart recovery-time 3600

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart select-defer-time 30

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart stalepath-time 3600

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart multiplier 8

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-SDWAN-Policy term Allow-All action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-SDWAN-Policy term Allow-All action community 8009:8009

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-SDWAN-Policy term Allow-All action community-action set-specific

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-SDWAN-Policy term Allow-VersaPvt-All match family versa-private

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-SDWAN-Policy term Allow-VersaPvt-All action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term Reject_DIA match community "(^|,)64513:64513($|,)"

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term Reject_DIA action reject

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Wildcard match family versa-private

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Wildcard action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term Wildcard action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 router-id 10.4.64.104

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 local-as as-number 64512

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group type internal

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group family inet unicast

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group family inet versa-private

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group family inet-vpn unicast

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group family inet6-vpn unicast

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group import Import-From-SDWAN-Policy

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group export TO_SDWAN

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group peer-as 64512

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group neighbor 10.4.64.1

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group neighbor 10.4.64.2

set routing-instances DUN-SubOrg-LAN-VR instance-type vrf

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T1-Paired-TVI-Direct match protocol direct

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T1-Paired-TVI-Direct match address 169.254.0.0/16

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T1-Paired-TVI-Direct action reject

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T2-DIRECT match protocol direct

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T2-DIRECT action accept

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T2-DIRECT action set-origin igp

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T2-DIRECT action set-local-preference 110

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T4-BGP match protocol bgp

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T4-BGP action accept

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T4-BGP action set-origin egp

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T4-BGP action set-local-preference 110

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy To-DUN-SubOrg-LAN-VR-Export term T1_SPOKE_SDWAN match protocol bgp

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy To-DUN-SubOrg-LAN-VR-Export term T1_SPOKE_SDWAN match community 8000:1

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy To-DUN-SubOrg-LAN-VR-Export term T1_SPOKE_SDWAN action accept

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribute-to-bgp Default-Policy-To-BGP

set routing-instances DUN-SubOrg-LAN-VR global-vrf-id 36

set routing-instances DUN-SubOrg-LAN-VR networks [ LAN-HUB1 ]

set routing-instances DUN-SubOrg-LAN-VR mpls-vpn-core-instance DUN-SubOrg-Control-VR

set routing-instances DUN-SubOrg-LAN-VR interfaces [ tvi-0/603.0 ]

set routing-instances DUN-SubOrg-LAN-VR route-distinguisher 8036L:104

set routing-instances DUN-SubOrg-LAN-VR vrf-export-target target:8036L:104

set routing-instances DUN-SubOrg-LAN-VR vrf-both-target target:36L:36

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 enable-alarms

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 routing-peer-policy From_ST_GW_INT term Color_ST_GW_Routes action accept

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 routing-peer-policy From_ST_GW_INT term Color_ST_GW_Routes action set-local-preference 100

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 routing-peer-policy Import-From-LAN-Policy term Reject-SDWAN-Routes match community "(^|,)8009:8009($|,)"

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 routing-peer-policy Import-From-LAN-Policy term Reject-SDWAN-Routes action reject

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 routing-peer-policy Import-From-LAN-Policy term Allow-All action accept

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 routing-peer-policy To_ST_DIA term Allow_Local_LAN match community "(^|,)8009:8009($|,)"

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 routing-peer-policy To_ST_DIA term Allow_Local_LAN action reject

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 routing-peer-policy To_ST_DIA term Allow_All action accept

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 router-id 169.254.0.36

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 local-as as-number 64514

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 group ST-GW-Group-1 type external

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 group ST-GW-Group-1 family inet unicast

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 group ST-GW-Group-1 import From_ST_GW_INT

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 group ST-GW-Group-1 local-address 169.254.0.3

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 group ST-GW-Group-1 peer-as 64513

set routing-instances DUN-SubOrg-LAN-VR protocols bgp 3048 group ST-GW-Group-1 neighbor 169.254.0.2

set routing-instances DUN-SubOrg-LAN-VR-Export instance-type vrf

set routing-instances DUN-SubOrg-LAN-VR-Export policy-options redistribution-policy Default-Policy term T1_TO_SDWAN action accept

set routing-instances DUN-SubOrg-LAN-VR-Export policy-options redistribution-policy Default-Policy term T1_TO_SDWAN action set-community 8000:0

set routing-instances DUN-SubOrg-LAN-VR-Export policy-options redistribute-to-bgp Default-Policy

set routing-instances DUN-SubOrg-LAN-VR-Export policy-options redistribute-to-bgp6 Default-Policy

set routing-instances DUN-SubOrg-LAN-VR-Export policy-options instance-import from-instance DUN-SubOrg-LAN-VR family inet policy To-DUN-SubOrg-LAN-VR-Export

set routing-instances DUN-SubOrg-LAN-VR-Export policy-options instance-import from-instance DUN-SubOrg-LAN-VR family inet6 policy To-DUN-SubOrg-LAN-VR-Export

set routing-instances DUN-SubOrg-LAN-VR-Export global-vrf-id 16036

set routing-instances DUN-SubOrg-LAN-VR-Export mpls-vpn-core-instance DUN-SubOrg-Control-VR

set routing-instances DUN-SubOrg-LAN-VR-Export route-distinguisher 16036L:104

set routing-instances DUN-SubOrg-LAN-VR-Export vrf-export-target target:16036L:104

@SPOKE1

set routing-instances DUN-SubOrg-Control-VR instance-type virtual-router

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term Paired-TVI-Reject match address 169.254.0.0/16

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term Paired-TVI-Reject action reject

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term SDWAN-TVI2-Reject match address 10.4.64.103/32

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term SDWAN-TVI2-Reject action reject

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term DIRECT match protocol direct

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term DIRECT action accept

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term DIRECT action set-origin igp

set routing-instances DUN-SubOrg-Control-VR policy-options redistribute-to-bgp Control-VR-Policy

set routing-instances DUN-SubOrg-Control-VR mpls-vpn-core

set routing-instances DUN-SubOrg-Control-VR interfaces [ ptvi17 tvi-0/17.0 ]

set routing-instances DUN-SubOrg-Control-VR routing-options mpls-vpn-local-router-interface family inet

set routing-instances DUN-SubOrg-Control-VR routing-options mpls-vpn-local-router-interface interface tvi-0/17.0

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 local-address 10.4.64.103

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart enable

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart maximum-restart-time 3600

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart recovery-time 3600

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart select-defer-time 30

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart stalepath-time 3600

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart multiplier 8

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Reject-VersaPvt-Spokes match family versa-private

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Reject-VersaPvt-Spokes match community "((^|,)8000:1($|,))|((^|,)8000:2($|,))"

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Reject-VersaPvt-Spokes action reject

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Reject-Spokes-DUN-SubOrg-LAN-VR match community "((^|,)8000:1($|,))|((^|,)8000:2($|,))"

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Reject-Spokes-DUN-SubOrg-LAN-VR match extended-community target:36L:36

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Reject-Spokes-DUN-SubOrg-LAN-VR action reject

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Hub-Priority1-DUN-SubOrg-LAN-VR match extended-community "target:16036L:104 target:8036L:104"

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Hub-Priority1-DUN-SubOrg-LAN-VR action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Hub-Priority1-DUN-SubOrg-LAN-VR action community 8009:8009

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Hub-Priority1-DUN-SubOrg-LAN-VR action community-action set-specific

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Hub-Priority1-DUN-SubOrg-LAN-VR action set-local-preference 101

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Allow-All action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Allow-All action community 8009:8009

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Allow-All action community-action set-specific

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Allow-VersaPvt-All match family versa-private

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Allow-VersaPvt-All action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Hub-Only match family versa-private

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Hub-Only action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Hub-Only action community 8000:2

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Hub-Only action community-action set-specific

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Hub-Only action next-term VersaPvt-Wildcard-Spoke

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Wildcard-Spoke match family versa-private

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Wildcard-Spoke action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Wildcard-Spoke action community 8000:1

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Wildcard-Spoke action community-action set-specific

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term Wildcard action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 router-id 10.4.64.103

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 local-as as-number 64512

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group type internal

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group family inet unicast

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group family inet versa-private

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group family inet-vpn unicast

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group family inet6-vpn unicast

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group import Import-From-Hubs-Policy

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group export TO_SDWAN

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group peer-as 64512

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group neighbor 10.4.64.1

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group neighbor 10.4.64.2

set routing-instances DUN-SubOrg-LAN-VR instance-type vrf

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T2-DIRECT match protocol direct

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T2-DIRECT action accept

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T2-DIRECT action set-community "8001:104 8000:2"

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T2-DIRECT action set-origin igp

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T2-DIRECT action set-local-preference 110

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribute-to-bgp Default-Policy-To-BGP

set routing-instances DUN-SubOrg-LAN-VR global-vrf-id 36

set routing-instances DUN-SubOrg-LAN-VR networks [ LAN-SPOKE1 ]

set routing-instances DUN-SubOrg-LAN-VR mpls-vpn-core-instance DUN-SubOrg-Control-VR

set routing-instances DUN-SubOrg-LAN-VR route-distinguisher 36L:36

set routing-instances DUN-SubOrg-LAN-VR vrf-import-target target:16036L:104

set routing-instances DUN-SubOrg-LAN-VR vrf-both-target target:36L:36

@SPOKE2

set routing-instances DUN-SubOrg-Control-VR instance-type virtual-router

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term Paired-TVI-Reject match address 169.254.0.0/16

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term Paired-TVI-Reject action reject

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term SDWAN-TVI2-Reject match address 10.4.64.105/32

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term SDWAN-TVI2-Reject action reject

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term DIRECT match protocol direct

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term DIRECT action accept

set routing-instances DUN-SubOrg-Control-VR policy-options redistribution-policy Control-VR-Policy term DIRECT action set-origin igp

set routing-instances DUN-SubOrg-Control-VR policy-options redistribute-to-bgp Control-VR-Policy

set routing-instances DUN-SubOrg-Control-VR mpls-vpn-core

set routing-instances DUN-SubOrg-Control-VR interfaces [ ptvi17 tvi-0/17.0 ]

set routing-instances DUN-SubOrg-Control-VR routing-options mpls-vpn-local-router-interface family inet

set routing-instances DUN-SubOrg-Control-VR routing-options mpls-vpn-local-router-interface interface tvi-0/17.0

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 local-address 10.4.64.105

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart enable

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart maximum-restart-time 3600

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart recovery-time 3600

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart select-defer-time 30

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart stalepath-time 3600

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 graceful-restart multiplier 8

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Reject-VersaPvt-Spokes match family versa-private

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Reject-VersaPvt-Spokes match community "((^|,)8000:1($|,))|((^|,)8000:2($|,))"

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Reject-VersaPvt-Spokes action reject

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Reject-Spokes-DUN-SubOrg-LAN-VR match community "((^|,)8000:1($|,))|((^|,)8000:2($|,))"

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Reject-Spokes-DUN-SubOrg-LAN-VR match extended-community target:36L:36

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Reject-Spokes-DUN-SubOrg-LAN-VR action reject

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Hub-Priority1-DUN-SubOrg-LAN-VR match extended-community "target:16036L:104 target:8036L:104"

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Hub-Priority1-DUN-SubOrg-LAN-VR action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Hub-Priority1-DUN-SubOrg-LAN-VR action community 8009:8009

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Hub-Priority1-DUN-SubOrg-LAN-VR action community-action set-specific

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Hub-Priority1-DUN-SubOrg-LAN-VR action set-local-preference 101

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Allow-All action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Allow-All action community 8009:8009

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Allow-All action community-action set-specific

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Allow-VersaPvt-All match family versa-private

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy Import-From-Hubs-Policy term Allow-VersaPvt-All action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Hub-Only match family versa-private

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Hub-Only action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Hub-Only action community 8000:2

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Hub-Only action community-action set-specific

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Hub-Only action next-term VersaPvt-Wildcard-Spoke

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Wildcard-Spoke match family versa-private

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Wildcard-Spoke action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Wildcard-Spoke action community 8000:1

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term VersaPvt-Wildcard-Spoke action community-action set-specific

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 routing-peer-policy TO_SDWAN term Wildcard action accept

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 router-id 10.4.64.105

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 local-as as-number 64512

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group type internal

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group family inet unicast

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group family inet versa-private

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group family inet-vpn unicast

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group family inet6-vpn unicast

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group import Import-From-Hubs-Policy

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group export TO_SDWAN

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group peer-as 64512

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group neighbor 10.4.64.1

set routing-instances DUN-SubOrg-Control-VR protocols bgp 8 group Controllers-Group neighbor 10.4.64.2

set routing-instances DUN-SubOrg-LAN-VR instance-type vrf

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T2-DIRECT match protocol direct

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T2-DIRECT action accept

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T2-DIRECT action set-community "8001:104 8000:2"

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T2-DIRECT action set-origin igp

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribution-policy Default-Policy-To-BGP term T2-DIRECT action set-local-preference 110

set routing-instances DUN-SubOrg-LAN-VR policy-options redistribute-to-bgp Default-Policy-To-BGP

set routing-instances DUN-SubOrg-LAN-VR global-vrf-id 36

set routing-instances DUN-SubOrg-LAN-VR networks [ LAN-SPOKE2 ]

set routing-instances DUN-SubOrg-LAN-VR mpls-vpn-core-instance DUN-SubOrg-Control-VR

set routing-instances DUN-SubOrg-LAN-VR route-distinguisher 36L:36

set routing-instances DUN-SubOrg-LAN-VR vrf-import-target target:16036L:104

set routing-instances DUN-SubOrg-LAN-VR vrf-both-target target:36L:36