End-to-end VRF lite without PE reconfiguration

Answered Question
Sep 8th, 2012

I am trying to setup an end-to-end VRF lite implementation, but am constrained by not having access to our Service Provider (SP)-managed PE routers. Our SP does offer us VRF capability (I believe this is as an additional MPLS-VPN rather than via VRF lite), but this comes at an additional cost we cannot currently budget for.

Currently, I've setup two seperate VRF lite domains on two of our MPLS CE routers, and linked these together using a GRE tunnel - the GRE tunnel itself forwards the VRF (ip forward vrf XYZ); but the "tunnel source" and "tunnel destination" are transitted across our default SP-provided VRF.

I've seen plenty of examples online, aimed at SPs, around how to configure the PE-CE router relationship around VRF lite and Multi-CE VRF etcetera - what I'm wondering, is if you are a customer of such a PE-CE VRF setup - as I am - and only have access as far as the MPLS CE router, is it possible to setup a "VRF-over-an-SP-VRF" setup - without needing reconfiguration by your SP?

To clarify, our setup is as follows - with the line below denoting who manages which aspect (Us or the SP):

Switch(es) -[IPv4]-> MPLS CE Router 1 -[IPv4 BGP]-> MPLS -[Dedicated MPLS-VPN/VRF]-> MPLS CE Router 2 -[IPv4]-> Switch(es)

Us                         Us                                              Service Provider                                  Us                                      Us

So currently, we have:

VLAN Test -[VRF forwarding]-> VRF-lite Test -[GRE transited over default VRF]-> VRF-lite Test [VRF Forwarding]-> VLAN Test

I have tried experimenting to run a "virtual point-to-point BGP" across the default VRF, with the intent of establishing a point-to-point BGP in the "address-family ipv4 vrf TEST" section of the router BGP configuration, but am unsure if this would even work - or if the neighbour lookup in the "address-family" section of the router BGP configuration is done in the VRF it is assigned to, or in the default VRF (router bgp NNNN)?

Would something like this be possible if I used PBR and route-targets/descriptors, to setup the VRF Test to route across the default VRF - or do I need my Service Provider's co-operation to transit a VRF from one point to another?

I have this problem too.
0 votes
Correct Answer by Mohamed Sobair about 1 year 7 months ago

Hello,

The Only way I can think of is a GRE-Multipoint implementation using the Cisco (Dynamic Multipoint VPN) - DMVPN.

It should be sufficient for your requirement, use the Search to lookup DMVPN Configuration example and let us know if you have other concern.

Regards,

Mohamed

  • 1
  • 2
  • 3
  • 4
  • 5
Average Rating: 5 (1 ratings)
Mohamed Sobair Sat, 09/08/2012 - 11:06

Hello,

You Can surely Setup end-to-end VRF-Lite without the intervention of the Service Provider, you ust need to have a VRF sets over a GRE Tunnel for example.  Over this VRF, you Can run what ever routing protocol of your choice depending on your requirement.

let me know if this answers your question,

Regards,

Mohamed

spoofneted Sun, 09/09/2012 - 07:33

Moahamed,

This is exactly what we have already done - setup a GRE tunnel to interconnect two VRF-lite implementations; with the GRE itself routed over the "default VRF" (Service Provider MPLS-VPN), and then forwarding our localised VRF-lite implementations to each other.

However, what I'm wondering is if we can extend this to be a point-to-multipoint implementation - where three or more sites can all inter-communicate using localised VRF-lite implementations. Is there a way of doing this without the GRE (i.e. a "VRF inside a VRF" - our VRF on top of the SP MPLS-VPN VRF), or of creating a point-to-multipoint GRE?

Thanks for your reply.

Correct Answer
Mohamed Sobair Sun, 09/09/2012 - 08:43

Hello,

The Only way I can think of is a GRE-Multipoint implementation using the Cisco (Dynamic Multipoint VPN) - DMVPN.

It should be sufficient for your requirement, use the Search to lookup DMVPN Configuration example and let us know if you have other concern.

Regards,

Mohamed

spoofneted Sun, 09/09/2012 - 08:46

Mohamed,

Thanks very much - I too have just stumbled upon DMVPN, and it does seem to be my only option unless I pay the money to use VRF-over-MPLS with my SP.

Actions

Login or Register to take actions

This Discussion

Posted September 8, 2012 at 9:33 AM
Stats:
Replies:4 Avg. Rating:5
Views:899 Votes:0
Shares:0

Related Content

Discussions Leaderboard