Route Distinguishers and Route Targets are both important components of Layer 3 MPLS VPNs. They serve very similar roles and it is easy to confuse them or not understand why both are needed. They are key differences which I’ll be explaining in this article to help newcomers better understand the Layer 3 VPN. What is the difference between Route Distinguishers and Route Targets? Let’s take a look.
Key Definitions
These are some terms and definitions that we need to understand first before we can understand Route Distinguishers and Route targets.
Multi-Protocol Label Switching (MPLS) – MPLS is a framework which allows routers to route traffic based on short unique labels rather than IP Addresses. It prevents core routers from having to look up IP addresses when forwarding traffic and allows the encapsulation of data with labels.
Border Gateway Protocol (BGP) – BGP is the only routing protocol that supports VPNv4. It does this through MP-BGP.
Multi-Protocol BGP (MP-BGP) – An extension to BGP that allows it to carry additional protocols other than IPv4. This is what allows BGP to carry VPNv4 and VPNv6 routes. MP-BGP also carries additional attributes such as Route Targets and VPN labels.
VPN Label – A type of MPLS forwarding label that identifies which L3VPN a customer’s packet belongs to. It serves a similar purpose in the data plane to what VPNv4 routes accomplish in the control plane.
VPNv4/VPNv6 – A special address family that combines a regular IPv4 or IPv6 route with a Route Distinguisher creating a globally unique route. This is a route advertisement format, not to be confused with the vpn label which is a data forwarding label.
Route Distinguishers
Why do we need Route Distinguishers?
When we advertise a customer’s routes between PE routers in an L3VPN, we are advertising their internal private IP addresses, not globally unique public IP addresses. This means that two customers will likely have the same or overlapping routes which will cause conflicts.
For example, Customer A and Customer B might both be using 10.0.0.0/24. If we weren’t using Route Distinguishers, our PE routers would have two identical routes although it can only install one in the routing table. With VPNv4/v6, routes are advertised as rd:prefix. So if my route distinguisher is 500:1 for Customer A and 500:2 for Customer B, then the advertised routes will be 500:1:10.0.0.0/24 and 500:2:10.0.0.0/24. This allows us to reuse the same private ip subnets in a routing table without causing conflict.
At this point you may be thinking that since the customer’s routes are stored in the VRF routing table they are separate from each other anyway so why do we need a route distinguisher? This is what I thought at first. The answer is that before the routes get imported into a VRF, they are stored in a global bgp VPNv4/v6 Address table on the PE router. This address table contains all customer routes learned via VPNv4/v6 and this is where we need Route Distinguishers to keep them unique. Inside the customer VRF we only see the original route without the route distinguisher.
Route Targets
Route targets exist to control which VRF routes get imported into. They are an MP-BGP attribute that the router shares along with the VPNv4/v6 route. Route targets are one tool that allows us to apply policies to traffic on Layer 3 VPNs.
We configure Route Targets in the VRF configuration section of the router. There are two route targets per VRF, import and export. The import route target tells the router “if a route has this target, add it to this VRF’s routing table.” The export route target tells the router “when sharing a route from this VRF (over MP-BGP) add this route target to it”.
It is normal for the import and export target to be the same. However they can be different. One case in which they would be different is a “Hub and Spoke” VPN design. You can allow the hub (HQ) to import all spoke routes, and only allow the spoke routes to import hub routes. In this design the spokes do not learn routes to other spokes. This would look like the following:
Hub VRF
export RT 500:100
import RT 500:200Spoke VRF
export RT 500:200
import RT 500:100Why We Need Both
When I first learned about Route Distinguishers and Route Targets this was my biggest question. Why do we need both? Basically if we only had route distinguishers, the router wouldn’t be able to import those routes into the VRF routing table. If we only had route targets, the router wouldn’t be able to keep overlapping routes separate in its VPNv4/v6 routing table.
The bigger question is why was VPNv4/v6 designed this way. Why not program routers to import routes based on a route distinguisher or segregate them based on a route target? The answer to this is granularity.
There are situations in which you may want to use different route targets with the same route distinguisher, such as the case of the hub and spoke L3VPN I mentioned earlier. There are also cases in which you may want to use different route distinguishers but the same route target. Route distinguishers do not need to be the same for all routes in a VRF.
For example imagine a provider wants to load balance between two paths to a customer route. The customer can be advertising the same route to two different PE routers. If we use the same route distinguisher on both PE routers, then routers only install the best route in their routing tables. If we use different route distinguishers then we can install both routes in the PE routing tables and load balance between them. This example comes from Harold Ritter’s comment here.
Summary
I hope that this post helps people understand what the difference is between route distinguishers and route targets. This is one of the hardest concepts to learn when it comes to Layer 3 VPN design. I will be doing some labs to demonstrate various applications of route distinguishers and route targets and ways to manipulate them. I’ll link to them when I post them so that you can see real examples of these concepts. Thank you for reading.