Provider Edge Link Protection in Layer 3 VPNs

A precomputed protection path can be configured in a Layer 3 VPN such that if a link between a CE router and a PE router goes down, the protection path (also known as the backup path) between the CE router and an alternate PE router can be used. This is useful in an MPLS service provider network, where a customer can have dual-homed CE routers that are connected to the service provider through different PE routers. In this case, the protection path avoids disruption of service if a PE-CE link goes down.

The protection path can be configured on a PE router in a Layer 3 VPN by configuring the protection statement at the [edit routing-instances instance-name protocols bgp family inet unicast] or [edit routing-instances instance-name protocols bgp family inet6 unicast] hierarchy level.

The protection statement indicates that protection is required on prefixes received from a particular neighbor or family. After protection is enabled for a given family, group, or neighbor, protection entries are added for prefixes or next hops received from the respective peer.

A protection path can be selected only if the best path has already been installed by BGP in the forwarding table. This is because a protection path cannot be used as the best path. There are two conditions under which the protection path will not work:

• When configured for an internal BGP peer.
• When configured with external and internal BGP multipath.