CCIE SPv4 MPLS L2VPN VPLS BGP-AD LDP Signaling Inter AS Option A

Howdy folks!

It's been a long time in the making but I am finally back on the SP trail, this time for good and to finally finish what I started what seems like ages ago. I want to finally get done with CCIE SPv4, earn my second CCIE and move to other tracks once and for all. I have always enjoy SP topics, MPLS VPN, L2 and L3 especially, this time around I am attacking the blueprint from more of a review aspect rather than learning it for the first time.

I have also moved to running EVE-NG, after spending an entire weekend getting it up and running. It's not quite as responsive as VMs running in ESXi, but the flexibility can't be beat.

I have already covered L2VPN VPLS BGP AD with both LDP and BGP signaling in previous posts so I won't be diving into that as much. I find recluse topics like Inter AS L2VPN to not be widely documented so I figured as continue plowing through the technologies, I'll pick up where I left off with SP content.

The last time we checked out VPLS with BGP AD LDP/BGP signaling, it was in a single AS, which makes it pretty easy to work with. I liken L2VPN Option A to L3VPN Option A, the ASBRs treat each other as CE devices and create ACs on the attached connections. All that is really needed is a service instance and encapsulation to get it to work. If you were to take the previous posts on VPLS, you could pretty easily get Inter AS L2VPN up and running.

In the above screen shot, we have our topology, which is quite large, but gives us lots of flexibility to test different technologies out with. In the large SP, CSR5 is a BGP Route Reflector, CSR1, CSR4, CSR2 and XRv4 are PEs configured to run VPLS BGP AD with LDP signaling.  In the SP in the upper right, CSR14 is a BGP Route Reflector, CSR11, CSR10 and CSR12 are configured to run VPLS BGP AD with LDP signaling. CSR2 and CSR14 are physically wired to each other and their locally connected interfaces are configured to be ACs to the remote ASBR. XRv doesn't support L2VPN in the data plane, the configuration is shown only for reference.

I'll lay out the configuration from left to right then show the verification and show the EIGRP adjacencies the CE routers have between each other.

SP 100

CSR5 (BGP Route Reflector)
router bgp 100
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor IBGP peer-group
 neighbor IBGP remote-as 100
 neighbor IBGP update-source Loopback0
 neighbor 1.1.1.1 peer-group IBGP
 neighbor 1.1.1.2 peer-group IBGP
 neighbor 1.1.1.4 peer-group IBGP
 neighbor 1.1.1.6 peer-group IBGP
 neighbor 1.1.1.14 peer-group IBGP
 !
 address-family ipv4
 exit-address-family
 !
 address-family vpnv4
 exit-address-family
 !
 address-family l2vpn vpls
  neighbor IBGP send-community extended
  neighbor IBGP route-reflector-client
  neighbor 1.1.1.1 activate
  neighbor 1.1.1.2 activate
  neighbor 1.1.1.4 activate
  neighbor 1.1.1.6 activate
  neighbor 1.1.1.14 activate
  neighbor 1.1.1.14 prefix-length-size 2
 exit-address-family


CSR1, CSR4
router bgp 100
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 1.1.1.5 remote-as 100
 neighbor 1.1.1.5 update-source Loopback0
 neighbor 1.1.1.11 remote-as 100
 neighbor 1.1.1.11 update-source Loopback0
 !
 address-family ipv4
 exit-address-family
 !
 address-family vpnv4
 exit-address-family
 !
 address-family l2vpn vpls
  neighbor 1.1.1.5 activate
  neighbor 1.1.1.5 send-community extended
  neighbor 1.1.1.11 activate
  neighbor 1.1.1.11 send-community extended
 exit-address-family
!
interface GigabitEthernet3
 service instance 1 ethernet
  encapsulation default
!
l2vpn vfi context VPLS_AD_LDP 
 vpn id 100
 autodiscovery bgp signaling ldp 
!
bridge-domain 100 
 member GigabitEthernet3 service-instance 1
 member vfi VPLS_AD_LDP


CSR2 (SP ASBR)
router bgp 100
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 1.1.1.5 remote-as 100
 neighbor 1.1.1.5 update-source Loopback0
 neighbor 1.1.1.11 remote-as 100
 neighbor 1.1.1.11 update-source Loopback0
 !
 address-family ipv4
 exit-address-family
 !
 address-family vpnv4
 exit-address-family
 !
 address-family l2vpn vpls
  neighbor 1.1.1.5 activate
  neighbor 1.1.1.5 send-community extended
  neighbor 1.1.1.11 activate
  neighbor 1.1.1.11 send-community extended
 exit-address-family
!
l2vpn vfi context VPLS_AD_LDP 
 vpn id 100
 autodiscovery bgp signaling ldp 
!
bridge-domain 100 
 member GigabitEthernet3 service-instance 1
 member GigabitEthernet4 service-instance 1
 member vfi VPLS_AD_LDP
!
interface GigabitEthernet3
 service instance 1 ethernet
  encapsulation default
 !
interface GigabitEthernet4
 service instance 1 ethernet
  encapsulation default


XRv4
router bgp 100
 address-family vpnv4 unicast
 !
 address-family l2vpn vpls-vpws
 !
 neighbor 1.1.1.5
  remote-as 100
  update-source Loopback0
  session-open-mode active-only
  address-family vpnv4 unicast
  !
  address-family l2vpn vpls-vpws
   Signalling bgp disable
!
interface GigabitEthernet0/0/0/3
 l2transport
!
l2vpn
 logging
  pseudowire
 !
 bridge group VPLS_AD_LDP
  bridge-domain VPLS_AD_LDP
   interface GigabitEthernet0/0/0/3
   !
   vfi VPLS_AD_LDP
    vpn-id 100
    autodiscovery bgp
     rd 100:100
     route-target import 100:100
     route-target export 100:100
     signaling-protocol ldp



SP 200

CSR14 (BGP Route Reflector)
router bgp 200
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 2.2.2.10 remote-as 200
 neighbor 2.2.2.10 update-source Loopback0
 neighbor 2.2.2.11 remote-as 200
 neighbor 2.2.2.11 update-source Loopback0
 neighbor 2.2.2.12 remote-as 200
 neighbor 2.2.2.12 update-source Loopback0
 !
 address-family ipv4
 exit-address-family
 !
 address-family l2vpn vpls
  neighbor 2.2.2.10 activate
  neighbor 2.2.2.10 route-reflector-client
  neighbor 2.2.2.11 activate
  neighbor 2.2.2.11 route-reflector-client
  neighbor 2.2.2.12 activate
  neighbor 2.2.2.12 route-reflector-client

 exit-address-family
!
interface GigabitEthernet3
 no ip address
 negotiation auto
 service instance 1 ethernet

  encapsulation default
!
l2vpn vfi context VPLS_AD_LDP 
 vpn id 100
 autodiscovery bgp signaling ldp 
!
bridge-domain 100 
 member GigabitEthernet3 service-instance 1

 member vfi VPLS_AD_LDP


CSR11
router bgp 200
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 2.2.2.14 remote-as 200
 neighbor 2.2.2.14 update-source Loopback0
 !
 address-family ipv4
 exit-address-family
 !
 address-family l2vpn vpls
  neighbor 2.2.2.14 activate
 exit-address-family
!
interface GigabitEthernet3
 service instance 1 ethernet
  encapsulation default
!
l2vpn vfi context VPLS_AD_LDP 
 vpn id 100
 autodiscovery bgp signaling ldp 
!
bridge-domain 100 
 member GigabitEthernet3 service-instance 1
 member vfi VPLS_AD_LDP


CSR10 and CSR12
router bgp 200
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 2.2.2.14 remote-as 200
 neighbor 2.2.2.14 update-source Loopback0
 !
 address-family ipv4
 exit-address-family
 !
 address-family l2vpn vpls
  neighbor 2.2.2.14 activate
 exit-address-family
!
interface GigabitEthernet3
 service instance 1 ethernet
  encapsulation default
!
l2vpn vfi context VPLS_AD_LDP 
 vpn id 100
 autodiscovery bgp signaling ldp 
!
bridge-domain 100 
 member GigabitEthernet3 service-instance 1
 member vfi VPLS_AD_LDP

With the configuration complete, we can now begin verification. We'll look at CSR2, XRv4 and CSR11 then check a couple CEs.

CSR2#show mpls l2transport vc 

Local intf     Local circuit              Dest address    VC ID      Status
-------------  -------------------------- --------------- ---------- ----------
VFI VPLS_AD_LDP  \
               vfi                        1.1.1.1         100        UP        
VFI VPLS_AD_LDP  \
               vfi                        1.1.1.4         100        UP        
VFI VPLS_AD_LDP  \
               vfi                        1.1.1.14        100        UP        


CSR2#show l2vpn vfi 
Legend: RT=Route-target, S=Split-horizon, Y=Yes, N=No

VFI name: VPLS_AD_LDP, state: up, type: multipoint, signaling: LDP
  VPN ID: 100, VPLS-ID: 100:100
  RD: 100:100, RT: 100:100, 
  Bridge-Domain 100 attachment circuits:
  Pseudo-port interface: pseudowire100001
  Interface          Peer Address     VC ID        Discovered Router ID    S
  pseudowire100004   1.1.1.14         100          1.1.1.14                Y
  pseudowire100003   1.1.1.4          100          1.1.1.4                 Y
  pseudowire100002   1.1.1.1          100          1.1.1.1                 Y


CSR2#show l2vpn atom  vc 

                                       Service
Interface Peer ID         VC ID      Type   Name                     Status
--------- --------------- ---------- ------ ------------------------ ----------
pw100002  1.1.1.1         100        vfi    VPLS_AD_LDP              UP        
pw100003  1.1.1.4         100        vfi    VPLS_AD_LDP              UP        
pw100004  1.1.1.14        100        vfi    VPLS_AD_LDP              UP

The outputs above are different methods of looking at the same thing. The PWs are up and working. The Transport label, PE to PE connectivity is allocated via LDP, the PW label, is also allocated by LDP when the PW forms. We are not creating PWs manually here, we are leveraging BGP to Auto Discover PEs enabled for VPLS and then creating PWs on demand. You'll notice that the PW numbers start at 100000. 

CSR2#show bridge-domain 100
Bridge-domain 100 (5 ports in all)
State: UP                    Mac learning: Enabled
Aging-Timer: 300 second(s)
    GigabitEthernet3 service instance 1
    GigabitEthernet4 service instance 1
    vfi VPLS_AD_LDP neighbor 1.1.1.1 100
    vfi VPLS_AD_LDP neighbor 1.1.1.4 100
    vfi VPLS_AD_LDP neighbor 1.1.1.14 100
   AED MAC address    Policy  Tag       Age  Pseudoport
   0   5000.0019.0001 forward dynamic   299  VPLS_AD_LDP.1004012
   0   5000.001C.0001 forward dynamic   295  GigabitEthernet3.EFP1
   0   5000.001F.0001 forward dynamic   296  GigabitEthernet4.EFP1
   0   5000.0018.0001 forward dynamic   295  VPLS_AD_LDP.1004011
   0   5000.0022.0000 forward dynamic   297  GigabitEthernet4.EFP1
   0   5000.0021.0001 forward dynamic   296  GigabitEthernet4.EFP1

The above output shows CSR2, which is a PE and ASBR, connection to another SP, shows several MAC addresses being learned. VPLS_AD_LDP indicates a MAC learned over a PW created on demand. The GigabitEthernet3.EFP1 indicates that the MAC was learned in on the AC from the either the CE or ASBR.

RP/0/0/CPU0:XRv4#show l2vpn atom-db 
Mon Nov 26 00:00:53.156 UTC

Peer ID         Source          VC ID                 Encap  SIG    FEC AD     
_______________________________________________________________________________

1.1.1.1         1.1.1.14        100:100               MPLS   LDP    129 BGP    
1.1.1.2         1.1.1.14        100:100               MPLS   LDP    129 BGP    
1.1.1.4         1.1.1.14        100:100               MPLS   LDP    129 BGP    

RP/0/0/CPU0:XRv4#show l2vpn bridge-domain 
Mon Nov 26 00:01:35.403 UTC
Legend: pp = Partially Programmed.
Bridge group: VPLS_AD_LDP, bridge-domain: VPLS_AD_LDP, id: 0, state: up, ShgId: 0, MSTi: 0
  Aging: 300 s, MAC limit: 4000, Action: none, Notification: syslog
  Filter MAC addresses: 0
  ACs: 1 (1 up), VFIs: 1, PWs: 3 (3 up), PBBs: 0 (0 up)
  List of ACs:
    Gi0/0/0/3, state: up, Static MAC addresses: 0
  List of Access PWs:
  List of VFIs:
    VFI VPLS_AD_LDP (up)
      Neighbor 1.1.1.1 pw-id 100:100, state: up, Static MAC addresses: 0
      Neighbor 1.1.1.2 pw-id 100:100, state: up, Static MAC addresses: 0
      Neighbor 1.1.1.4 pw-id 100:100, state: up, Static MAC addresses: 0

IOS XR has similar outputs, the fitst of which shows the PWs are up and running. The control Plane is working. The Bridge Domain on the other hand shows no MACs being learned. I have read that the XRv9000 in later code, 6.4 and later will support L2VPN in the data plane, I haven't tested this out. You could be tested on this in the lab, so it's worth knowing how to configure it.

CSR11#show mpls l2transport vc 

Local intf     Local circuit              Dest address    VC ID      Status
-------------  -------------------------- --------------- ---------- ----------
VFI VPLS_AD_LDP  \
               vfi                        2.2.2.10        100        UP        
VFI VPLS_AD_LDP  \
               vfi                        2.2.2.12        100        UP        
VFI VPLS_AD_LDP  \
               vfi                        2.2.2.14        100        UP        


CSR11#show bridge-domain 100
Bridge-domain 100 (4 ports in all)
State: UP                    Mac learning: Enabled
Aging-Timer: 300 second(s)
    GigabitEthernet3 service instance 1
    vfi VPLS_AD_LDP neighbor 2.2.2.10 100
    vfi VPLS_AD_LDP neighbor 2.2.2.14 100
    vfi VPLS_AD_LDP neighbor 2.2.2.12 100
   AED MAC address    Policy  Tag       Age  Pseudoport
   0   5000.0019.0001 forward dynamic   295  VPLS_AD_LDP.1004012
   0   5000.001C.0001 forward dynamic   296  VPLS_AD_LDP.1004012
   0   5000.001F.0001 forward dynamic   296  VPLS_AD_LDP.1004013
   0   5000.0018.0001 forward dynamic   297  VPLS_AD_LDP.1004012
   0   5000.0022.0000 forward dynamic   298  GigabitEthernet3.EFP1
   0   5000.0021.0001 forward dynamic   296  VPLS_AD_LDP.1004011

CSR11 shows very similar output as CSR2 except this is strictly a PE.

IOSV1#sh ip eigrp nei
EIGRP-IPv4 Neighbors for AS(1)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
4   10.1.1.10               Gi0/1                    12 01:34:11   62   372  0  7
3   10.1.1.9                Gi0/1                    14 01:34:18  139   834  0  7
2   10.1.1.7                Gi0/1                    13 01:34:22   81   486  0  6
1   10.1.1.5                Gi0/1                    10 01:34:28   40   240  0  4
0   10.1.1.2                Gi0/1                    12 01:34:33 1168  5000  0  1

IOSv1 has 5 EIGRP peerings setup, this is done to keep the MACs in the BDs on the PEs and ASBRs as well as to prove that the data plane is working.

Thanks for stopping by!
Rob Riker, CCIE #50693

MPLS Inter AS Option 1 / Option A Back to Back VRF Exchange

In this post we will be taking a look at the "easiest" Inter AS VPN technique, at least in my opinion. It takes advantage of what is already understood with VRF connectivity, instead of connecting to a customer device, we peer with the remote provider in a VRF. This is done per customer, so for every customer we're trying to extend between the SPs, a VRF must be created. This also means that a routing protocol adjacency/peering needs to be configured as well. This is where the scalability of Option A becomes an issue, 1 for 1 VRFs and BGP/IGP peerings will quickly tie up resources on the ASBRs.

I added 2 new customers, each with a VRF, VPNA and VPNB. Having just a single customer on all the PE and ASBRs doesn't show the pros/cons of Option A. The cool thing about this design is that if a PE has a VRF configured with the appropriate RT import/export policy setup, it will only receive traffic that matches the RT policies. The drawback about this design is that an ASBR with multiple VRFs configured will have to form 1 to 1 VRF to IGP/BGP peerings with the remote ASBR.

The VRFs laid out below will be needed to learn and then propagate BGP routes between the providers.

R5 and R6
vrf definition CSC
 rd 1:1
 route-target export 1:1
 route-target import 1:1
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
vrf definition VPNA
 rd 2:2
 route-target export 2:2
 route-target import 2:2
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
vrf definition VPNB
 rd 3:3
 route-target export 3:3
 route-target import 3:3
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family



XR6
vrf TEST
 address-family ipv4 unicast
  import route-target
   1:1
  !
  export route-target
   1:1
  !
 !
 address-family ipv6 unicast
  import route-target
   1:1
  !
  export route-target
   1:1
  !
vrf VPNA
 address-family ipv4 unicast
  import route-target
   2:2
  !
  export route-target
   2:2
  !
 !
 address-family ipv6 unicast
  import route-target
   2:2
  !
  export route-target
   2:2
  !
 !
!
vrf VPNB
 address-family ipv4 unicast
  import route-target
   3:3
  !
  export route-target
   3:3
  !
 !
 address-family ipv6 unicast
  import route-target
   3:3
  !
  export route-target
   3:3
  !
 !
!


Now we'll have to apply the VRFs to interfaces.

R5#sh vrf
  Name                             Default RD            Protocols   Interfaces
  CSC                              1:1                   ipv4,ipv6   Gi1.56
  VPNA                             2:2                   ipv4,ipv6   Gi1.22
  VPNB                             3:3                   ipv4,ipv6   Gi1.33

R6#sh vrf
  Name                             Default RD            Protocols   Interfaces
  CSC                              1:1                   ipv4,ipv6   Gi1.56
                                                                     Gi1.166
  VPNA                             2:2                   ipv4,ipv6   Gi1.22
                                                                     Gi1.122
  VPNB                             3:3                   ipv4,ipv6   Gi1.33
                                                                     Gi1.133

RP/0/0/CPU0:XR6#sh ip int br | ex default
Thu Apr 12 15:01:34.989 UTC

Interface                      IP-Address      Status          Protocol Vrf-Name
GigabitEthernet0/0/0/0.122     100.64.122.16   Up              Up       VPNA 
GigabitEthernet0/0/0/0.133     100.64.133.16   Up              Up       VPNB 
GigabitEthernet0/0/0/0.166     100.64.166.16   Up              Up       TEST 


Now that the interfaces are in the correct VRFs, we can go ahead and setup the BGP configuration.

R5
router bgp 50693
 !
 address-family ipv4 vrf CSC
  neighbor 100.64.56.6 remote-as 2
  neighbor 100.64.56.6 activate
 exit-address-family
 !
 address-family ipv4 vrf VPNA
  neighbor 100.64.22.6 remote-as 2
  neighbor 100.64.22.6 activate
 exit-address-family
 !
 address-family ipv4 vrf VPNB
  neighbor 100.64.33.6 remote-as 2
  neighbor 100.64.33.6 activate
 exit-address-family


R6
router bgp 2
 address-family ipv4 vrf CSC
  neighbor 100.64.56.5 remote-as 50693
  neighbor 100.64.56.5 activate
  neighbor 100.64.166.16 remote-as 50693
  neighbor 100.64.166.16 activate
 exit-address-family
 !     
 address-family ipv4 vrf VPNA
  neighbor 100.64.22.5 remote-as 50693
  neighbor 100.64.22.5 activate
  neighbor 100.64.122.16 remote-as 50693
  neighbor 100.64.122.16 activate
 exit-address-family
 !
 address-family ipv4 vrf VPNB
  neighbor 100.64.33.5 remote-as 50693
  neighbor 100.64.33.5 activate
  neighbor 100.64.133.16 remote-as 50693
  neighbor 100.64.133.16 activate
 exit-address-family


XR6
router bgp 50693
  vrf TEST
  rd 1:1
  address-family ipv4 unicast
  !
  neighbor 100.64.166.6
   remote-as 2
   address-family ipv4 unicast
    route-policy RPL_EBGP_PEERINGS in
    route-policy RPL_EBGP_PEERINGS out
   !
  !
 !
 vrf VPNA
  rd 2:2
  address-family ipv4 unicast
  !
  neighbor 100.64.122.6
   remote-as 2
   address-family ipv4 unicast
    route-policy RPL_EBGP_PEERINGS in
    route-policy RPL_EBGP_PEERINGS out
   !
  !
 !
 vrf VPNB
  rd 3:3
  address-family ipv4 unicast
  !
  neighbor 100.64.133.6
   remote-as 2
   address-family ipv4 unicast
    route-policy RPL_EBGP_PEERINGS in
    route-policy RPL_EBGP_PEERINGS out

The next thing for us to do is verify the VRF/BGP configuration.

RP/0/0/CPU0:XR6#sh bgp vrf all summary | i "Neighbor|100.64."
Thu Apr 12 15:06:51.637 UTC
Neighbor        Spk    AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down  St/PfxRcd
100.64.166.6      0     2     371     334      110    0    0 05:28:33          6
Neighbor        Spk    AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down  St/PfxRcd
100.64.122.6      0     2      16      13      110    0    0 00:09:58          4
Neighbor        Spk    AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down  St/PfxRcd
100.64.133.6      0     2      16      13      110    0    0 00:09:57          4

R5#            sh bgp vpnv4 unicast all summary | b Neighbor
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
100.64.22.6     4            2     250     247       57    0    0 03:39:37        4
100.64.33.6     4            2     244     244       57    0    0 03:36:02        4
100.64.56.6     4            2     400     401       57    0    0 05:58:40        6
192.0.2.8       4        50693    1379    1343       57    0    0 20:08:40       12

R6# sh bgp vpnv4 unicast all summary | b Neighbor
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
100.64.22.5     4        50693     248     250       65    0    0 03:40:04        4
100.64.33.5     4        50693     245     244       65    0    0 03:36:29        4
100.64.56.5     4        50693     402     401       65    0    0 05:59:07        4
100.64.122.16   4        50693      18      21       65    0    0 00:14:20        2
100.64.133.16   4        50693      18      21       65    0    0 00:14:19        2
100.64.166.16   4        50693     338     375       65    0    0 05:32:56        4

Now that we have all the verification complete. We need to test.

R2#sh bgp ipv4 unicast | b Network
     Network          Next Hop            Metric LocPrf Weight Path
 r>  100.64.21.0/24   100.64.21.1              0             0 50693 i
 *>  100.64.114.0/24  100.64.21.1                            0 50693 2 65004 i
 *>  100.64.144.0/24  100.64.21.1                            0 50693 2 65014 i
 *>  100.64.165.0/24  100.64.21.1                            0 50693 65016 i
 *>  100.64.222.0/24  100.64.21.1                            0 50693 2 65014 i
 *>  100.64.233.0/24  100.64.21.1                            0 50693 2 65014 i
 *>  192.0.2.2/32     0.0.0.0                  0         32768 i
 *>  192.0.2.4/32     100.64.21.1                            0 50693 2 65004 i
 *>  192.0.2.14/32    100.64.21.1                            0 50693 2 65014 i
 *>  192.0.2.16/32    100.64.21.1                            0 50693 65016 i

We see that we've learned several loopbacks, R4, R14 and R16. We trace to R14 from our loopback.

R2#traceroute 192.0.2.14 source lo0 num
Type escape sequence to abort.
Tracing the route to 192.0.2.14
VRF info: (vrf in name/id, vrf out name/id)
  1 100.64.21.1 [AS 50693] 5 msec 3 msec 3 msec
  2 100.64.18.8 [MPLS: Labels 20/44 Exp 0] 6 msec 6 msec 7 msec
  3 100.64.56.5 [MPLS: Label 44 Exp 0] 14 msec 16 msec 15 msec
  4 100.64.56.6 19 msec 11 msec 10 msec
  5 100.64.106.10 [MPLS: Labels 22/24010 Exp 0] 16 msec 25 msec 17 msec
  6 100.64.103.13 [MPLS: Labels 24008/24010 Exp 0] 20 msec 19 msec 21 msec
  7 100.64.134.14 [MPLS: Label 24010 Exp 0] 18 msec 19 msec 20 msec
  8 100.64.144.14 [AS 65014] 21 msec *  11 msec

We reach it taking the R5-R6 path to get there. You'll also notice that the traceroute is 2 LSPs and an IP path. LSP1 is R1 to R5, the IP path is R5 to R6 and LSP2 is R6 to XR4. This is expected with option A since it is back to back VRF exchange. There is no label exchange or allocation.

R12#sh bgp ipv4 unicast | b Network
     Network          Next Hop            Metric LocPrf Weight Path
 *>  100.64.121.0/24  0.0.0.0                  0         32768 i
 *>  100.64.144.0/24  100.64.121.11                          0 50693 2 65014 i
 *>  100.64.178.0/24  100.64.121.11                          0 50693 65018 i
 *>  100.64.222.0/24  100.64.121.11                          0 50693 2 65014 i
 *>  100.64.233.0/24  100.64.121.11                          0 50693 2 65014 i
 *>  192.0.2.12/32    0.0.0.0                  0         32768 i
 *>  192.0.2.14/32    100.64.121.11                          0 50693 2 65014 i
 *>  192.0.2.18/32    100.64.121.11                          0 50693 65018 i

We check R12 as well, which is a different customer. We see that R18 and R14 loopbacks are learned. R14 is peered with XR4 in all VRFs, so it has visibility in all VPNs. This can be done by peering the PE to the CE in all VRFs or simply importing/exporting the right RT values in the VRF confguration.

R12#traceroute 192.0.2.14 so lo0 num
Type escape sequence to abort.
Tracing the route to 192.0.2.14
VRF info: (vrf in name/id, vrf out name/id)
  1 100.64.121.11 2 msec 2 msec 1 msec
  2 100.64.151.15 [MPLS: Labels 20/49 Exp 0] 8 msec 9 msec 7 msec
  3 100.64.158.8 [MPLS: Labels 20/49 Exp 0] 28 msec 31 msec 31 msec
  4 100.64.33.5 [MPLS: Label 49 Exp 0] 21 msec 21 msec 20 msec
  5 100.64.33.6 20 msec 13 msec 12 msec
  6 100.64.106.10 [MPLS: Labels 22/24014 Exp 0] 15 msec 20 msec 20 msec
  7 100.64.103.13 [MPLS: Labels 24008/24014 Exp 0] 23 msec 19 msec 23 msec
  8 100.64.134.14 [MPLS: Label 24014 Exp 0] 25 msec 19 msec 22 msec
  9 100.64.233.14 [AS 65014] 22 msec *  14 msec

We trace over the Inter AS path, again with 2 LSPs and 1 IP path. We also have Intra AS reachability with R18 but the focus was Inter AS here.