VRF lite question

Answered Question
Aug 19th, 2010

Hello, i am hoping someone can help answer the following question.

If i create a VRF on a switch (to provide traffic seperation on a remote site switch) and place an SVI in that VRF but do not enable MP-BGP, is there a VRF tag applied to traffic on that vlan? Therefore, if i have trunk connection to my SP (Layer2 VPN) that carries the VLAN that my SVI belongs to, will my HQ site that connects to the same VLAN, need to be VRF aware? Or will i still be able to establish an EIGRP peering between remote sites?

To summarize:

HQ and remote site have EIGRP peering established, over VLAN10. The vlan is extended end to end via the SP L2 VPN. Both HQ and remote office switches are currently using global routing table.

I want to create a new VRF at remote site and place the SVI for theVLAN that connects to the HQ in that VRF. Will the HQ and remote office still be able to form EIGRP neighbor?

Thanks

rays

I have this problem too.
0 votes
Correct Answer by Jerry Ye about 6 years 5 months ago

The HQ will see the regular route, no RD or RT attached. In fact, VRF-Lite will not care about the RD or RT configured (verified with a sniffer trace). Some older software will force you to configure it but the newer one will not. However, it is always a best practice to configure it.

Regards,

jerry

Correct Answer by Jeremy Buck about 6 years 5 months ago

Just set it up in the lab... basically you don't use the stamping.

Attached are the configs for HQ and Remote.

HQ is using a native table and a VLAN 10 sub-interface to the Remote router.

Remote is running VRF-lite with a VLAN 10 and 20 subinterface of which 10 is coupled to vrf "eigrp_vrf." It wasn't working for a minute until I added the autonomous-system command to the address family... which was giving me a minor headache.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
Chetan Kumar Ress Thu, 08/19/2010 - 11:23

Hi Ray

If you configure VRF in remote site but not in HQ the you will not able to communicate with HQ .

VRF is virtual routing table . If you configured any SVI interface to vrf then that interface or that network will not show in global routing table.

You can see that interface & route in VRF table. [ show ip route vrf (name) ]

vrf will create a instance of routing table.

So if you configure vrf in remote location then you should have vrf in HQ to communicate.

MP-BGP is used in ISP cloud to send an VPNv4 update to remote PE . In customer network is won't require .

please refer the bwlo link :

http://packetlife.net/blog/2009/apr/30/intro-vrf-lite/

http://packetlife.net/blog/2010/mar/29/inter-vrf-routing-vrf-lite/

Regards

Chetan kumar

http://chetanress.blogspot.com

Jerry Ye Thu, 08/19/2010 - 11:23

Assuming your ISP allowing trunk between your sites. You have to configure address-family in your existing EIGRP process to allow the VRF to form the neighbor.

Here is the example and the link:

Router(config)# router eigrp 1

Router(config-router)# address-family ipv4 vrf RED

Router(config-router-af)# autonomous-system 101

Router(config-router-af)# network 172.16.0.0

Router(config-router-af)# default-metric 10000 100 255 1 1500
Router(config-router-af)# exit-address-family

http://www.cisco.com/en/US/docs/ios/iproute_eigrp/command/reference/ire_a1.html#wp1056908

HTH,

jerry

Jeremy Buck Thu, 08/19/2010 - 11:45

Just to add to what's been said by the others... These are the fundamentals of VRF:

1) VRF creates a "virtual router" which is separate than your "native router."

2) You must specify which interfaces are attached to your "virtual router" under interface configuration mode (or else you will have no interfaces on that router).

3) Creating a VRF instance configures the router to stamp it's routing updates with a route descriptor, this stamp is used to inform other routers which "virtual-router" these updates are for.

4) Configuring VRF will not segregate data traffic. In order to segregate data traffic over the same link between the two routers on each side (the native and the virtual router) you would need to implement dot1q tagging and/or another layer 2 tagging technology like DLCI's or ATM PVC's. It seems that your provider is allowing QinQ tunneling so you can probably create a sub interface on the HQ and remote router and place the sub interface (dot1q) into the VRF.

So picture each VRF like a separate router with it's own interfaces.

-Jeremy

rays Thu, 08/19/2010 - 11:55

Thanks for the quick responses guys. Just to confirm, Jeremy you

are correct my SP is using Q in Q tunneling. I have a .1Q tunnel from my HQ to

the remote site (there are actually quite a few remote sites ) carrying 2x vlans, 10 and 20. Vlan 10 carries EIGRP and VLAN 20 OSPF. I was hoping to create a VRF at the remote site and place SVI interface VLAN10 in that VRF and still be able to form an EIGRP neighbor with my HQ. From what you have said i cannot do this without re-configuring my HQ to use VRF also. I was hoping to avoid reconfiguring the HQ...

Thanks,

rays

Jeremy Buck Thu, 08/19/2010 - 12:24

Rays,

Are you trying to take the HQ native routing table (EIGRP) and peer with the remote-office routing table (VRF-lite w/EIGRP) over VLAN 10?

I'm sure you can do that. I just explained how things are *normally* done but the whole point of VRF is to provide PE services to the CE and this is inline with that goal. I would set it up for you but I don't have my simulator loaded (I have a ticket to get it installed). I'm just not sure what the route-distinquisher's would look like or if you would have to use an import map (or maybe not use anything and just keep it simple).

If I can get in a position to configure this I will... I'm sure an IE will come along and answer your question if you keep it bumped.

-Jeremy

rays Thu, 08/19/2010 - 12:31

Thats exactly what i am trying to do! thanks Jeremy, sorry i didn't explain myself very well

I am not in a position to test this either so i thought this was the best place to look for an answer.

Thanks for looking into this for me.

rays

Jerry Ye Thu, 08/19/2010 - 12:43

Like Jeremy said, you don't have to reconfigure the HQ to VRF if you only want the remote to be on VRF. The remote's EIGRP process will need to configured with address-family and AS number match the HQ (of course, same L3 network also).

Also, there is no need to use import map command in your situation. Unless you are importing vpnv4 routes with different RT.

Regards,

jerry

rays Thu, 08/19/2010 - 12:50

Thanks Jerry. Although I am now curios by what Jeremy said, regarding what

happens with the RD when the routing update reaches the HQ global table.. I.e. how will the HQ handle the RD from the remote VRF..?

Correct Answer
Jeremy Buck Thu, 08/19/2010 - 13:54

Just set it up in the lab... basically you don't use the stamping.

Attached are the configs for HQ and Remote.

HQ is using a native table and a VLAN 10 sub-interface to the Remote router.

Remote is running VRF-lite with a VLAN 10 and 20 subinterface of which 10 is coupled to vrf "eigrp_vrf." It wasn't working for a minute until I added the autonomous-system command to the address family... which was giving me a minor headache.

Attachment: 
rays Thu, 08/19/2010 - 14:02

Thanks a lot Jeremy!

This is a great forum.

appreciated.

Correct Answer
Jerry Ye Thu, 08/19/2010 - 14:04

The HQ will see the regular route, no RD or RT attached. In fact, VRF-Lite will not care about the RD or RT configured (verified with a sniffer trace). Some older software will force you to configure it but the newer one will not. However, it is always a best practice to configure it.

Regards,

jerry

rays Thu, 08/19/2010 - 14:15

Excellent, thanks a lot for verifying for me Jerry.

Thanks everyone.

Actions

This Discussion