Topology as follows:
\ | /
\ | /
The software version of NE40 is VRP3.10-2226.
NE40A, NE40B, NE40C and NE40D are placed in the same autonomous system (AS100). NE40B and NE40C enable RR. NE40A and NE40D are clients. NE40A and NE40D build MBGP relation with NE40B and NE40C. DCN host through the loading of MPLS VPN at NE40A and NE40D cannot ping through opposite port.
1. Check the configuration of NE40B and NE40C, there is no VPN route filter.
2. Check configuration at NE40A and NE40D, there is no ACL filter.
3. With the command of display mpls lsp vpn-instance dcn-oa there is no VPN route allocation tag.
4. Check NE40A configuration (display ip route vpn-instance dcn-oa) and VPN route has been learned. It indicates MBGP has sent the route.
5. The next hop of VPN route is 10.0.0.1. Check the route of public network of 10.0.0.1 and find the route mask of 10.0.0.1 is 30-bit, not 32-bit. Here is problematic.
6. Check configuration at NE40D, NE40B and NE40C. It is found that NE40D and two RR use MBGP of the interface. For NE40 of 2226 version, it can only use 32-bit IP address when it builds MP-IBGP, not non-32-bit physical IP address.
7. Change the configuration at NE40D, NE40B and NE40C and use 32-bit mask loopback interface. VPN service of NE40A and NE40D is normal.
Common reasons are as follows:
1. The route of public network is unreachable.
2. The route of public network is reachable, but there is no 32-bit mask route of opposite device.
3. LSP tunnel of public network is not built.
4. The route of VPN private network is not learned.
5. Filter data packet through ACL.
NE40 device releases tag of private network only for 32-bit mask route and not handle other-bit mask route. Although there is LSP of public network at the device, there is no LSP of private network.