I have the following configuration for a RT translation but seems not working:

ip extcommunity-list standard RT-TRANSLATION-IN permit rt 2:200

route-map RM-RT-TRANSLATION-IN permit 10
match extcommunity RT-TRANSLATION-IN
set extcommunity rt 2:202

address-family vpnv4
[…]
neighbor 192.168.17.5 activate
neighbor 192.168.17.5 send-community both
neighbor 192.168.17.5 route-map RM-RT-TRANSLATION-IN in
exit-address-family

On ASBR I can see the route-map counter at zero:

ASBR-R7#show route-map
route-map RM-RT-TRANSLATION-IN, permit, sequence 10
Match clauses:
extcommunity (extcommunity-list filter):RT-TRANSLATION-IN
Set clauses:
extended community RT:2:202
Policy routing matches: 0 packets, 0 bytes

On ASBR's neighbor I can see the route imported with the "wrong" RT (10.0.20.0 should have from rt 2:200 to rt: 2:202)

Route Distinguisher: 2:200

*>i10.0.20.0/24 7.7.7.7 0 100 0 65000 ?
Route Distinguisher: 2:202
*>i10.0.15.0/24 4.4.4.4 2662400 100 0 ?

However, on PE router I can see that it recognizes the route under the right VRF despite the wrong rt

Route Distinguisher: 2:200
*>i 10.0.20.0/24 7.7.7.7 0 100 0 65000 ?
Route Distinguisher: 2:202 (default for vrf BLUE)
*> 10.0.15.0/24 192.168.45.6 2662400 32768 ?
*>i 10.0.20.0/24 7.7.7.7 0 100 0 65000 ?

Can someone explain me why:

Route-Map doesn't work
PE imports the route under the right VRF despite the wrong RT
I can tell you that:

The route is received correctly with the rt 2:200 (verified via pcap trace)
The PE's VRF import target only 2:202

I had the same problem on the neighbor ASBR IOS-XR. I'm quite sure is my configuration error but I cannot spot it.
Thanks

This is based on RFC4090 (http://tools.ietf.org/html/rfc4090)

So my question… has Cisco or Juniper implemented the one to one protections? I can't seem to find any way of configuring that.

• Start off with password key configured, then password requirement, the session is reset.

R4(config)#mpls ldp password option 10 for 3 LDP-KEY R4(config)#MPLs LDp PASSword REquired FOR 3 R4(config)# *Jul 8 23:47:34.471: %LDP-5-NBRCHG: LDP Neighbor 3.3.3.3:0 (3) is DOWN (Session's MD5 password changed) R4(config)# *Jul 8 23:47:37.259: %LDP-5-NBRCHG: LDP Neighbor 3.3.3.3:0 (2) is UP R4(config)#

• Start off with password requirement, session is reset right away.

R4(config)#mpls ldp password required for 3 R4(config)# *Jul 8 23:50:10.635: %LDP-5-NBRCHG: LDP Neighbor 3.3.3.3:0 (2) is DOWN (Session's MD5 password changed) R4(config)# *Jul 8 23:50:12.347: %LDP-4-PWD: MD5 protection is required for peer 3.3.3.3:0, no password configured