Thanks Martin But we have to implement it in a single vrf .is their any way that we could have only a single vrf for all customers sites and that all sites can only communicate with hub site.and communication with each other should be forbidden i think u got my point.

Hi,

What is the reason for the single VRF requirement? A single VRF will act as a single router, i.e. interconnect all networks in the routing table by default. So the only option remaining, if a single VRF is not negotiable, is to use packet filters (ACLs). The example in my first post is offering a much more elegant way of achieving the requirements you stated so far, except the number of VRFs.

Regards, Martin

Thanx for ur previous post actually this is our client requirement that they want a single vrf for all client branches.and just that client branches can only talk to HUB branch.i have implemented it with ACL but it would be difficult to manage.Also in our design all the Client branches are coming on the single router that is 10720.So you can see if their are 700 branches then their would be 700 vrf`s.if u can tell a way or mpls has some sort of support that we could have only 1 vrf and we can control their routing to hub branch effiencitenly.your early reply would be highly appreciated.

Hello

there are 2 ways you can do this.

1. you dont need to use 700 vrf for all spoke locations . only 2 vrf will do. one for hub and other for spoke.

like

vrf hub

route target export hub

route target import spoke

vrf spoke

route target export spoke

route target import hub

2. in case you want it with only one vrf use the import map command and import the routes of hub location only.

HTH

regards

Ashish gupta

thanx gupta.i think it would be very clear if u illustrate both these with an example.

Hi,

one VRF as given in the example will not do, because the VRF RIB will interconnect all spokes.

Actually there is one scalable method for you, check out "Configuring Scalable Hub-and-Spoke MPLS VPNs"

http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a0080442090.html

It uses one upstream VRF and one downstream VRF per interface (other interfaces than vts should be good as well). This should pretty much fulfill all your requirements. ONE VRF is impossible or needs ACLs - an operational nightmare.

Hope this helps! Please rate all posts.

Regards, Martin

Yes.I agree with martin.i have tried to worked it out with route import and export and it doesnot seems to work.bcoz of that VRF RIB.i will try the other method and then let u know that does that fulfill our requirement or not.Thanx for ur time.

Since the requirement puts in a lot of restrcitions you can although come up with a innovative solution out of the box, which is generally not recommended.

You can propose using GRE tunnels between the HUB n Spokes. When doing this the GRE tunnels is built using the VRF routing table, and only the upstream traffic to other spokes goes via the GRE tunnel and lands directly on the HUB, the downstream from the HUB to the other spokes always takes the VRF interface path via the PE.

Only benefit i see with this option over the ACL is the operational overheads being reduced as its only a one time implementation when you deploy the connectivity from CE-PE.

Although this is not the recommended way to implement Hub n spoke, but again considering the extreme restrictions, this works well.

HTH-Cheers,

Swaroop