# L3VPN Hub-and-Spoke

> MPLS L3VPN hub-and-spoke topology on VyOS with BGP VPNv4 - carrier-grade VPN service, PE/CE routing, VRF configuration, and MPLS label distribution

Source: https://opennix.org/en/docs/vyos/examples/l3vpn-hub-spoke/


L3VPN Hub-and-Spoke with MPLS and BGP VPNv4 for service provider multi-tenant topologies.

## Scenario

- Service Provider: MPLS backbone with customer VPN
- Hub-and-Spoke: Centralized HUB site for branch offices
- VRF: Isolation of customer routing tables

## Topology

```
      ┌─────────────────────────────┐
      │   MPLS Backbone (P/PE)      │
      │                             │
      │   ┌──────────────────┐      │
      │   │  HUB PE (VyOS)   │      │
      │   │  VRF CUSTOMER-A  │      │
      │   └────────┬─────────┘      │
      │            │                │
      │  ┌─────────┼─────────┐      │
      │  │         │         │      │
      │  ▼         ▼         ▼      │
      │ PE1       PE2       PE3     │
      │ (Spoke)   (Spoke)   (Spoke) │
      └─────────────────────────────┘
```

## VyOS HUB PE Configuration

```bash
# VRF
set vrf name CUSTOMER-A table '100'

# MP-BGP
set protocols bgp system-as '65000'
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-A rd '65000:100'
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-A route-target export '65000:100'
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-A route-target import '65000:100'

# MPLS
set protocols mpls ldp interface 'eth0'
set protocols mpls ldp router-id '10.255.0.1'

# BGP neighbors (spokes)
set protocols bgp neighbor 10.255.0.2 remote-as '65000'
set protocols bgp neighbor 10.255.0.2 address-family vpnv4-unicast
```

## Spoke PE Configuration

Similar to the HUB, but the spoke PE imports only HUB routes (not other spokes) for a hub-and-spoke topology.

## References

- [VyOS MPLS](https://docs.vyos.io/en/latest/configuration/protocols/mpls.html)
- [RFC 4364 - BGP/MPLS IP VPNs](https://datatracker.ietf.org/doc/html/rfc4364)
- [VyOS L3VPN Example](https://docs.vyos.io/en/latest/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.html)