I have OSPF and MPLS enabled in network and run xconnects to transmit L2 traffic. But also have just Internet clients that want public IP addresses. So I configure public IP on interface towards client. Problem is that all is global routing table, so clients can access IPs from core local ISP network.

How to improve it by design? that client's with public IP can't acccess core IPs. As I understand I should create VRF "Internet" and what next? BGP MP-BGP is needed?

PE -- client is always static IP, no IGP here.

  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Commented Dec 23, 2021 at 19:17

2 Answers 2


There are several different ways to accomplish this. Here's one way, assuming you're already running MP-BGP:

In the ISP VRF, have separate route tags for import and export, say 100 and 200 respectively. The VRF exports the default route with RT 200.

Each customer VRF imports 200, and exports its address block with RT 100.

In this way, the ISP VRF sees everyone's networks, but each customer only sees the default.


I use one vrf for all my customer public’s ip’s, as well as my internet boundary routes.

All in one vrf (aka mpls l3vpn)

Yes you will need mp-ibgp

Please do yourself a favor and setup a dual hub route reflector that all mp-ibgp PE’s peer with, you will be glad you did

Check out my service provider (ccnp sp) playlist. I hope to have a video soon for L3VPN info


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.