In an OSPF-based Layer 3 VPN, routes learned from a CE router are advertised across the MPLS backbone and presented to the remote CE router as OSPF inter-area routes (Type 3 LSAs). This is a default loop-prevention mechanism. A direct, physical link between two customer sites, known as a "back door" link, is seen as an intra-area path. According to OSPF path selection rules, an intra-area path is always preferred over an inter-area path, regardless of the metric.

A sham link is a logical, unnumbered point-to-point intra-area link configured between the PE routers within the VPN routing instance. This makes the path over the MPLS backbone appear as an intra-area link to the CE routers. With both the backbone and the back door link now appearing as intra-area paths, OSPF will use the metric to determine the best route, allowing the VPN backbone to be preferred by configuring it with a lower cost.

A. Rejecting routes via policy would completely block the backup path, preventing failover if the primary VPN link fails, which is not the desired outcome.

B. OSPF traffic engineering (OSPF-TE) is used to advertise link attributes for MPLS-TE path calculation and does not change the fundamental OSPF preference for intra-area over inter-area routes.

C. The OSPF metric is only considered when comparing paths of the same type. An intra-area path will always be chosen over an inter-area path, irrespective of the metric.

1. Juniper Networks TechLibrary

"Understanding OSPF Sham Links": "If there is a backdoor link that connects two of the OSPF sites

the backdoor link is always preferred over the BGP/MPLS VPN backbone link. This is because OSPF prefers an intra-area link over an interarea link. To make the BGP/MPLS VPN backbone the preferred link

you can configure an OSPF sham link between the PE routers that are connected to the OSPF sites."

2. RFC 4577: OSPF as the Provider/Customer Edge Protocol for BGP/MPLS IP Virtual Private Networks (VPNs)

Section 4.2.8. The Sham Link: "If there is a "backdoor" link between two CE routers that are in the same OSPF area

the path over that link will always be preferred to the path over the BGP/MPLS IP VPN backbone. This is because OSPF prefers intra-area paths to inter-area paths. To make the path over the backbone preferable to the backdoor path

one may create a "sham link" between the PEs."

3. Juniper Networks TechLibrary

"Example: Configuring an OSPF Sham Link for a VPN": This document provides a configuration example explicitly designed to "direct traffic between two customer sites across a VPN backbone rather than a backdoor OSPF link

" confirming the sham link's purpose.