# L3VPN Hub-and-Spoke

> Топология MPLS L3VPN hub-and-spoke на VyOS с BGP VPNv4 - операторский VPN-сервис, маршрутизация PE/CE, настройка VRF и распределение меток.

Source: https://opennix.org/docs/vyos/examples/l3vpn-hub-spoke/


L3VPN Hub-and-Spoke с MPLS и BGP VPNv4 для service provider multi-tenant topologies.

## Сценарий

- Service Provider: MPLS backbone с customer VPN
- Hub-and-Spoke: Централизованный HUB site для branch offices
- VRF: Изоляция customer routing tables

## Topology

```
      ┌─────────────────────────────┐
      │   MPLS Backbone (P/PE)      │
      │                             │
      │   ┌──────────────────┐      │
      │   │  HUB PE (VyOS)   │      │
      │   │  VRF CUSTOMER-A  │      │
      │   └────────┬─────────┘      │
      │            │                │
      │  ┌─────────┼─────────┐      │
      │  │         │         │      │
      │  ▼         ▼         ▼      │
      │ PE1       PE2       PE3     │
      │ (Spoke)   (Spoke)   (Spoke) │
      └─────────────────────────────┘
```

## VyOS HUB PE Configuration

```bash
# VRF
set vrf name CUSTOMER-A table '100'

# MP-BGP
set protocols bgp system-as '65000'
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-A rd '65000:100'
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-A route-target export '65000:100'
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-A route-target import '65000:100'

# MPLS
set protocols mpls ldp interface 'eth0'
set protocols mpls ldp router-id '10.255.0.1'

# BGP neighbors (spokes)
set protocols bgp neighbor 10.255.0.2 remote-as '65000'
set protocols bgp neighbor 10.255.0.2 address-family vpnv4-unicast
```

## Spoke PE Configuration

Аналогично HUB, но spoke PE импортирует только HUB routes (не другие spokes) для hub-and-spoke topology.

## Ссылки

- [VyOS MPLS](https://docs.vyos.io/en/latest/configuration/protocols/mpls.html)
- [RFC 4364 - BGP/MPLS IP VPNs](https://datatracker.ietf.org/doc/html/rfc4364)
- [VyOS L3VPN Example](https://docs.vyos.io/en/latest/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.html)