--- title: Hub-and-Spoke VPN on a Single PE-Router « ipSpace.net blog description: A hands-on walkthrough of implementing a hub-and-spoke VPN topology on a single PE router using inter-VRF route leaking. The lab uses Arista cEOS as the PE... canonical: https://daily.dev/posts/hub-and-spoke-vpn-on-a-single-pe-router-ipspace-net-blog-ll8er4yqc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hub-and-Spoke VPN on a Single PE-Router « ipSpace.net blog | daily.dev og:description: A hands-on walkthrough of implementing a hub-and-spoke VPN topology on a single PE router using inter-VRF route leaking. The lab uses Arista cEOS as the PE... og:url: https://daily.dev/posts/hub-and-spoke-vpn-on-a-single-pe-router-ipspace-net-blog-ll8er4yqc og:image: https://api.daily.dev/og/posts/ll8er4YQC.png og:image:alt: Hub-and-Spoke VPN on a Single PE-Router « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hub-and-Spoke VPN on a Single PE-Router « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 9 min read · 0 upvotes · 0 comments ## Summary A hands-on walkthrough of implementing a hub-and-spoke VPN topology on a single PE router using inter-VRF route leaking. The lab uses Arista cEOS as the PE router and FRR containers as CE routers, configured via netlab. Four VRFs are required: two spoke VRFs (s_1, s_2), hub_ingress, and hub_egress. Spoke VRFs export routes to hub_egress and import from hub_ingress. BGP AS-override is needed on the hub_ingress EBGP session. Traceroute and BGP table output confirm traffic flows correctly through the hub site before reaching other spokes, validating the design. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I implement hub-and-spoke VPN routing on a single PE router using inter-VRF route leaking? A hub-and-spoke VPN on a single PE router requires four VRFs: two spoke VRFs, hub_ingress, and hub_egress. Spoke VRFs export routes to hub_egress and import from hub_ingress. BGP AS-override must be configured on the hub_ingress EBGP session to prevent route rejection due to AS-path loop detection. Traffic from spoke to spoke traverses the spoke VRF, exits to the hub CE, re-enters via hub_egress VRF, then reaches the destination spoke. _Network engineers building VPN topologies like this track new netlab features and BGP design patterns on daily.dev._ ### Why does the BGP AS path for a spoke-to-spoke route contain two copies of the hub AS number in a hub-and-spoke VPN? In a hub-and-spoke VPN, the hub CE receives a route from the PE (carrying the spoke's AS), then re-advertises it back to the PE. The PE prepends its own AS when sending to the hub, and the hub prepends its AS when returning the route. This results in the hub AS appearing twice in the path — once for each direction through the hub CE — plus the original spoke AS. _Developers and network engineers debugging BGP path issues find relevant deep-dives on daily.dev._ ## Similar posts on daily.dev - [MPLS/VPN with SR-MPLS Core « ipSpace.net blog](https://daily.dev/posts/mpls-vpn-with-sr-mpls-core-ipspace-net-blog-nw3uwiphe) · ipSpace.net Blog · 0 upvotes · 0 comments - [Multivendor SR-MPLS « ipSpace.net blog](https://daily.dev/posts/multivendor-sr-mpls-ipspace-net-blog-qekokwduk) · ipSpace.net Blog · 0 upvotes · 0 comments - [EVPN with SR-MPLS Core « ipSpace.net blog](https://daily.dev/posts/evpn-with-sr-mpls-core-ipspace-net-blog-taobtibzc) · ipSpace.net Blog · 0 upvotes · 0 comments - [BGP-Free Core with SR-MPLS « ipSpace.net blog](https://daily.dev/posts/bgp-free-core-with-sr-mpls-ipspace-net-blog-h7kronzy3) · ipSpace.net Blog · 0 upvotes · 0 comments --- Tags: [#bgp](https://daily.dev/tags/bgp), [#networking](https://daily.dev/tags/networking) [View this post on daily.dev](https://daily.dev/posts/hub-and-spoke-vpn-on-a-single-pe-router-ipspace-net-blog-ll8er4yqc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hub-and-Spoke VPN on a Single PE-Router « ipSpace.net blog","url":"https://daily.dev/posts/hub-and-spoke-vpn-on-a-single-pe-router-ipspace-net-blog-ll8er4yqc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hub-and-spoke-vpn-on-a-single-pe-router-ipspace-net-blog-ll8er4yqc"},"datePublished":"2026-08-11T08:51:51.666Z","dateModified":"2026-10-15T02:19:30.915Z","description":"A hands-on walkthrough of implementing a hub-and-spoke VPN topology on a single PE router using inter-VRF route leaking. The lab uses Arista cEOS as the PE...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hub-and-spoke-vpn-on-a-single-pe-router-ipspace-net-blog-ll8er4yqc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"bgp,networking","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"Hub-and-Spoke VPN on a Single PE-Router « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hub-and-spoke-vpn-on-a-single-pe-router-ipspace-net-blog-ll8er4yqc#faq","mainEntity":[{"@type":"Question","name":"How do I implement hub-and-spoke VPN routing on a single PE router using inter-VRF route leaking?","acceptedAnswer":{"@type":"Answer","text":"A hub-and-spoke VPN on a single PE router requires four VRFs: two spoke VRFs, hub_ingress, and hub_egress. Spoke VRFs export routes to hub_egress and import from hub_ingress. BGP AS-override must be configured on the hub_ingress EBGP session to prevent route rejection due to AS-path loop detection. Traffic from spoke to spoke traverses the spoke VRF, exits to the hub CE, re-enters via hub_egress VRF, then reaches the destination spoke. Network engineers building VPN topologies like this track new netlab features and BGP design patterns on daily.dev."}},{"@type":"Question","name":"Why does the BGP AS path for a spoke-to-spoke route contain two copies of the hub AS number in a hub-and-spoke VPN?","acceptedAnswer":{"@type":"Answer","text":"In a hub-and-spoke VPN, the hub CE receives a route from the PE (carrying the spoke's AS), then re-advertises it back to the PE. The PE prepends its own AS when sending to the hub, and the hub prepends its AS when returning the route. This results in the hub AS appearing twice in the path — once for each direction through the hub CE — plus the original spoke AS. Developers and network engineers debugging BGP path issues find relevant deep-dives on daily.dev."}}]} ```