BGP VPN created, how do I give access to internet

Question

Head office is using real routers and switches and The redundancy btw HQ1 and HQ2 works.
The rest of the network is inside GNS3, for now there is no connections between real routes and GNS3 (I will work on that later).

But inside GNS3 I have a complete lab with head office talking to the two sites (PBA,PBB,BPC, P2 and P3 simulate the internet).

I want head office (they will also have PC and IP phone) to also talk to the real internet, and I am a bit puzzle about that because if a tunnel exist btw the routers (HQ1/HQ2) and the two sites, I beleive all the traffic will go there, how can I gain internet access when it is not for the sites?

I can use an interface on HQ1/HQ2 with probably an ACL? but a better solution would be to add a default route from the simulate internet to the real internet (ACL, default route?).
I know this way beyond CCNA level, but this is for a project and I am having fun.

Answer 1

There are a few different ways to achieve what you are after. In my experience the easiest way to do this is to use vlans between the Service Provider "PE" router and the Customer "CE" router. One VLAN would connect into the MPLS l3vpn (vrf) and the second VLAN would connect to an internet VRF/or default routing table.

Quite often I have found that a customer will have a large firewall appliance either at their head office or sitting in a datacenter. I would configure the headend router/firewall (CE) on the PE connection as follows:

VLAN x -> Connects to l3vpn cust-a-l3vpn on the PE -> advertises and recieves routes via ospf/bgp/rip/static (pick your flavor). Headend router advertises a default route into the l3vpn.

VLAN y -> Connects to default routing table on the PE -> Could have BGP configured if needed, otherwise static default is sufficient. Redistribute this route to the l3vpn.

The l3vpn sites would learn that they can get to the internet via the headend router through means of the advertised default route. The head end router would essentially be a "router on a stick" for traffic coming from the l3vpn to the internet.

Another popular option is to give internet access to each l3vpn site individually through use of two vlans. Each site would have a default route as above and would not advertise it into the l3vpn. The l3vpn would then only be used for private site to site traffic.

How you design and implement it is based on whatever requirements there are in the particular situation. (Redundancy, cost, available equipment, traffic volumes, etc.)

Hope this helps.

Cheers,

~H