Solved: Interconnecting VRFs

Shawnw4401 · ‎11-23-2016

Hello,

I am putting together a test lab for VRFs. I want multiple different VRFs to connect to one VRF but not share any information between the other VRFs.

For an example:

I have a VRF for computers "ip vrf Computers" and I want this to talk to "ip vrf Servers"; however, I want another VRF for phones "ip vrf Phones" to talk to "ip vrf Servers" but not "ip vrf Computers". Is there anyway to do this?

ip vrf Computers
rd 25:1
!
ip vrf MGMT
rd 10:1
!
ip vrf Servers
rd 71:1
!
ip vrf Wi-Fi
rd 49:1
!
interface Loopback25410
ip vrf forwarding MGMT
ip address 192.168.254.10 255.255.255.255
!
interface Loopback25425
ip vrf forwarding Computers
ip address 192.168.254.25 255.255.255.255
!
interface Loopback25449
ip vrf forwarding Wi-Fi
ip address 192.168.254.49 255.255.255.255
!
interface Loopback25471
ip vrf forwarding Servers
ip address 192.168.254.71 255.255.255.255
!
interface Vlan10
ip vrf forwarding MGMT
ip address 192.168.0.2 255.255.255.252
!
interface Vlan25
ip vrf forwarding Computers
ip address 192.168.52.2 255.255.255.248
!
interface Vlan49
ip vrf forwarding Wi-Fi
ip address 192.168.94.34 255.255.255.240
!
interface Vlan71
ip vrf forwarding Servers
ip address 192.168.17.18 255.255.255.248
!
ip route vrf MGMT 0.0.0.0 0.0.0.0 192.168.0.1
ip route vrf Servers 0.0.0.0 0.0.0.0 192.168.17.17
ip route vrf Wi-Fi 0.0.0.0 0.0.0.0 192.168.94.33
ip route vrf Computers 0.0.0.0 0.0.0.0 192.168.52.1
ip route vrf Computers 192.168.52.0 255.255.255.248 Vlan71 192.168.17.17

Mark Malone · ‎11-25-2016

Yes you must use BGP

You can not configure two static routes to advertise each prefix between the VRFs, because this method is not supported—packets will not be routed by the router. To achieve route leaking between VRFs, you must use the import functionality of route-target and enable Border Gateway Protocol (BGP) on the router. No BGP neighbor is required

Heres a quick example you could just redistribute it locally to confirm its working correct on vrf leaking side as a test without setting up neighbours , that should get it working :)

http://www.cisco.com/c/en/us/support/docs/multiprotocol-label-switching-mpls/multiprotocol-label-switching-vpns-mpls-vpns/47807-routeleaking.html#diffvrfs

View solution in original post

Mark Malone · ‎11-24-2016

Hi

Yes you need to import/export the vrfs between each other and chose what that see that way , vrf route leaking , so below both vrfs green and red can see the shared vrf by importing the RT 65000:99

#example

ip vrf Green
rd 65000:2
route-target export 65000:2
route-target import 65000:99
!
ip vrf Red
rd 65000:1
route-target export 65000:1
route-target import 65000:99
!
ip vrf Shared
rd 65000:99
route-target export 65000:99
route-target import 65000:1
route-target import 65000:2

Shawnw4401 · ‎11-24-2016

Mark,

Thank you for your response. I made the changes for the route-target imports/exports, however, I am still not able to communicate with that VRF.

ip vrf Computers
rd 25:1
route-target export 25:1
route-target import 71:1
!
ip vrf MGMT
rd 10:1
!
ip vrf Servers
rd 71:1
route-target export 71:1
route-target import 25:1
route-target import 49:1
!
ip vrf Wi-Fi
rd 49:1
route-target export 49:1
route-target import 71:1
!
ip cef

Do I need BGP as well? I've noticed that some of the examples of VRF to VRF use BGP vpnv4.

Mark Malone · ‎11-25-2016

Yes you must use BGP

You can not configure two static routes to advertise each prefix between the VRFs, because this method is not supported—packets will not be routed by the router. To achieve route leaking between VRFs, you must use the import functionality of route-target and enable Border Gateway Protocol (BGP) on the router. No BGP neighbor is required

Heres a quick example you could just redistribute it locally to confirm its working correct on vrf leaking side as a test without setting up neighbours , that should get it working :)

http://www.cisco.com/c/en/us/support/docs/multiprotocol-label-switching-mpls/multiprotocol-label-switching-vpns-mpls-vpns/47807-routeleaking.html#diffvrfs

Shawnw4401 · ‎11-25-2016

Mark,

I have not really worked much with BGP routing. The setup seems to be working now, sort of. Here's the current issue I am having now:
Router #1:

LAN_Router_1#show ip route vrf Computers

Routing Table: Computers
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+ - replicated route, % - next hop override

Gateway of last resort is not set

192.168.17.0/24 is variably subnetted, 2 subnets, 2 masks
B 192.168.17.16/29
is directly connected (Servers), 00:14:02, GigabitEthernet0/1.71
L 192.168.17.17/32 is directly connected, GigabitEthernet0/1.71
192.168.52.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.52.0/29 is directly connected, GigabitEthernet0/1.25
L 192.168.52.1/32 is directly connected, GigabitEthernet0/1.25
192.168.254.0/32 is subnetted, 3 subnets
C 192.168.254.24 is directly connected, Loopback25424
O 192.168.254.25
[110/2] via 192.168.52.2, 00:15:55, GigabitEthernet0/1.25
B 192.168.254.70
is directly connected (Servers), 00:14:02, Loopback25470
LAN_Router_1#show ip vrf Computers
Name Default RD Interfaces
Computers 25:1 Lo25424
Gi0/1.25
LAN_Router_1#
LAN_Router_1#ping vrf Computers 192.168.17.17
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.17.17, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
LAN_Router_1#ping vrf Computers 192.168.17.18
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.17.18, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
LAN_Router_1#ping vrf Computers 192.168.52.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.52.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
LAN_Router_1#ping vrf Computers 192.168.52.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.52.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

Switch #1:

LAN_Switch#show ip route vrf Computers

Routing Table: Computers
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is 192.168.52.1 to network 0.0.0.0

192.168.52.0/29 is subnetted, 1 subnets
C 192.168.52.0 is directly connected, Vlan25
192.168.17.0/29 is subnetted, 1 subnets
B 192.168.17.16 is directly connected, 00:07:09, Vlan71
192.168.254.0/32 is subnetted, 4 subnets
O 192.168.254.24 [110/2] via 192.168.52.1, 00:15:48, Vlan25
C 192.168.254.25 is directly connected, Loopback25425
B 192.168.254.70 [20/2] via 192.168.17.17 (Servers), 00:07:09, Vlan71
B 192.168.254.71 is directly connected, 00:07:09, Loopback25471
S* 0.0.0.0/0 [1/0] via 192.168.52.1
LAN_Switch#ping vrf Computers ip 192.168.17.18

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.17.18, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
LAN_Switch#ping vrf Computers ip 192.168.17.17

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.17.17, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
LAN_Switch#ping vrf Computers ip 192.168.52.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.52.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
LAN_Switch#ping vrf Computers ip 192.168.52.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.52.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/9 ms

The switch cannot ping vrf Servers 192.168.17.17 which is located on Router 1, Interface g0/1.71 -- Note: this happens from both vrf: Computers and Wi-Fi

interface GigabitEthernet0/1.71
encapsulation dot1Q 71
ip vrf forwarding Servers
ip address 192.168.17.17 255.255.255.248
ip nat inside
ip virtual-reassembly in

Mark Malone · ‎11-28-2016

what way do you see that non working route on sw1 compared to another working route from router 1 , check the show ip route 192.168.17.17 and compare it to another route , post what you see , it should be seen as local route looking at the outputs same as 192.168.52.1 is that correct instead of a BGP route ? is there a 192.168.17.x interface on the switch ?

Shawnw4401 · ‎11-29-2016

Mark,

Sorry for the late response, but here was the finding:

From Switch 1:

LAN_Switch#show run int vlan 71
Building configuration...

Current configuration : 93 bytes
!
interface Vlan71
ip vrf forwarding Servers
ip address 192.168.17.18 255.255.255.248
!
LAN_Switch#show ip route vrf Computers 192.168.17.17
Routing entry for 192.168.17.16/29
Known via "bgp 25", distance 20, metric 0 (connected, via interface), type external
Routing Descriptor Blocks:
* directly connected, via Vlan71
Route metric is 0, traffic share count is 1
AS Hops 0
!
LAN_Switch#show ip route vrf Computers 192.168.17.19
Routing entry for 192.168.17.16/29
Known via "bgp 25", distance 20, metric 0 (connected, via interface), type external
Routing Descriptor Blocks:
* directly connected, via Vlan71
Route metric is 0, traffic share count is 1
AS Hops 0
!
LAN_Switch#show ip int brief
Interface IP-Address OK? Method Status Protocol
Vlan1 unassigned YES NVRAM administratively down down
Vlan25 192.168.52.2 YES manual up up
Vlan71 192.168.17.18 YES manual up up
FastEthernet1/0/1 unassigned YES unset up up
FastEthernet1/0/2 unassigned YES unset up up
!
interface FastEthernet1/0/1 (Leads to 192.168.17.19)
switchport access vlan 71
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
end
---------
Ping results:

LAN_Switch#ping vrf Computers ip 192.168.17.17

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.17.17, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
LAN_Switch#ping vrf Computers ip 192.168.17.19

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.17.19, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

From Router1:

LAN_Router_1#show ip int brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/1.71 192.168.17.17 YES NVRAM up up
!

LAN_Router_1#show ip route vrf Computers 192.168.17.17

Routing Table: Computers
Routing entry for 192.168.17.17/32
Known via "connected", distance 0, metric 0 (connected)
Redistributing via bgp 25
Routing Descriptor Blocks:
* directly connected, via GigabitEthernet0/1.71
Route metric is 0, traffic share count is 1
LAN_Router_1#show ip route vrf Computers 192.168.17.19

Routing Table: Computers
Routing entry for 192.168.17.16/29
Known via "bgp 25", distance 20, metric 0 (connected, via interface), type external
Routing Descriptor Blocks:
* directly connected, via GigabitEthernet0/1.71
Route metric is 0, traffic share count is 1
AS Hops 0
MPLS label:
!
interface GigabitEthernet0/1.71
encapsulation dot1Q 71
ip vrf forwarding Servers
ip address 192.168.17.17 255.255.255.248
!
-------------------
ping results:
LAN_Router_1#ping vrf Computers ip 192.168.17.17
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.17.17, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
LAN_Router_1#ping vrf Computers ip 192.168.17.18
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.17.18, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
LAN_Router_1#ping vrf Computers ip 192.168.17.19
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.17.19, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

Mark Malone · ‎11-29-2016

Is the 192.168.17.17 subnet being advertised through an IGP too , would you mind uploading both full configs if its just a lab might be easier to see whats happening here

Shawnw4401 · ‎11-29-2016

Mark,

Switch config:

version 12.2
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname LAN_Switch
!
boot-start-marker
boot-end-marker
!
enable secret *******************
!
username stw privilege 15 secret *******************
!
!
macro global description NULL | NULL
!
no aaa new-model
clock timezone CST -6
switch 1 provision ws-c3750-24ts
system mtu routing 1500
ip routing
ip domain-name MyTestLab.com
ip name-server 192.168.17.19
ip name-server 8.8.8.8
ip name-server 8.8.4.4
!
!
ip vrf Computers
rd 25:1
route-target export 25:1
route-target import 71:1
!
ip vrf MGMT
rd 10:1
!
ip vrf Servers
rd 71:1
route-target export 71:1
route-target import 25:1
route-target import 49:1
!
ip vrf Wi-Fi
rd 49:1
route-target export 49:1
route-target import 71:1
!
!
!
!
!
!
!
!
spanning-tree mode rapid-pvst
spanning-tree logging
spanning-tree extend system-id
spanning-tree vlan 5 priority 24576
!
vlan internal allocation policy ascending
!
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh logging events
ip ssh version 2
!
!
!
interface Loopback0
ip address 192.168.254.5 255.255.255.255
!
interface Loopback25410
ip vrf forwarding MGMT
ip address 192.168.254.10 255.255.255.255
!
interface Loopback25425
ip vrf forwarding Computers
ip address 192.168.254.25 255.255.255.255
!
interface Loopback25449
ip vrf forwarding Wi-Fi
ip address 192.168.254.49 255.255.255.255
!
interface Loopback25471
ip vrf forwarding Servers
ip address 192.168.254.71 255.255.255.255
!
interface FastEthernet1/0/1
switchport access vlan 71
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/2
switchport access vlan 100
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/3
description ## Raspberry Pi ##
switchport access vlan 52
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/4
switchport access vlan 17
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/5
switchport access vlan 25
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/6
switchport access vlan 49
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/7
switchport access vlan 94
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/8
switchport access vlan 666
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/9
switchport access vlan 666
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/10
switchport access vlan 666
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/11
switchport access vlan 666
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/12
switchport access vlan 666
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/13
switchport access vlan 666
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/14
switchport access vlan 666
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/15
switchport access vlan 666
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/16
switchport access vlan 666
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/17
switchport access vlan 666
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/18
switchport access vlan 666
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/19
description ## PC ##
switchport access vlan 100
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/20
description ## X_BOX ##
switchport access vlan 100
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/21
description ## PC Connected to WiFi Router ##
switchport access vlan 100
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/22
switchport access vlan 25
switchport mode access
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet1/0/23
switchport trunk encapsulation dot1q
switchport trunk native vlan 777
switchport trunk allowed vlan 5,10,25,49,71
switchport mode trunk
!
interface FastEthernet1/0/24
switchport trunk encapsulation dot1q
switchport trunk native vlan 777
switchport trunk allowed vlan 5,17,52,94
switchport mode trunk
!
interface GigabitEthernet1/0/1
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,25,49,71
switchport mode trunk
!
interface GigabitEthernet1/0/2
switchport access vlan 666
shutdown
!
interface Vlan1
no ip address
shutdown
!
interface Vlan5
ip address 192.168.0.2 255.255.255.252
!
interface Vlan10
ip vrf forwarding MGMT
ip address 192.168.0.2 255.255.255.252
!
interface Vlan17
ip address 192.168.17.18 255.255.255.248
!
interface Vlan25
ip vrf forwarding Computers
ip address 192.168.52.2 255.255.255.248
!
interface Vlan49
ip vrf forwarding Wi-Fi
ip address 192.168.94.34 255.255.255.240
!
interface Vlan52
ip address 192.168.52.2 255.255.255.248
!
interface Vlan71
ip vrf forwarding Servers
ip address 192.168.17.18 255.255.255.248
!
interface Vlan94
ip address 192.168.94.34 255.255.255.240
!
interface Vlan100
ip address 192.168.10.2 255.255.255.0
!
router ospf 10 vrf MGMT
router-id 192.168.254.10
log-adjacency-changes
network 192.168.0.0 0.0.0.3 area 0
network 192.168.254.10 0.0.0.0 area 0
!
router ospf 25 vrf Computers
router-id 192.168.254.25
log-adjacency-changes
network 192.168.52.0 0.0.0.7 area 0
network 192.168.254.25 0.0.0.0 area 0
!
router ospf 49 vrf Wi-Fi
router-id 192.168.254.49
log-adjacency-changes
network 192.168.94.32 0.0.0.15 area 0
network 192.168.254.49 0.0.0.0 area 0
!
router ospf 71 vrf Servers
router-id 192.168.254.71
log-adjacency-changes
network 192.168.17.16 0.0.0.7 area 0
network 192.168.254.71 0.0.0.0 area 0
!
router ospf 5
router-id 192.168.254.5
log-adjacency-changes
network 192.168.0.5 0.0.0.0 area 1
network 192.168.10.2 0.0.0.0 area 2
network 192.168.17.17 0.0.0.0 area 2
network 192.168.52.1 0.0.0.0 area 2
network 192.168.94.33 0.0.0.0 area 2
network 192.168.254.5 0.0.0.0 area 0
!
router bgp 25
no synchronization
bgp log-neighbor-changes
no auto-summary
!
address-family ipv4 vrf Wi-Fi
redistribute connected
redistribute ospf 49 vrf Wi-Fi
no synchronization
exit-address-family
!
address-family ipv4 vrf Servers
redistribute connected
redistribute ospf 71 vrf Servers
no synchronization
exit-address-family
!
address-family ipv4 vrf Computers
redistribute connected
redistribute ospf 25 vrf Computers
no synchronization
exit-address-family
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.0.1
ip route vrf MGMT 0.0.0.0 0.0.0.0 192.168.0.1
ip route vrf Servers 0.0.0.0 0.0.0.0 192.168.17.17
ip route vrf Wi-Fi 0.0.0.0 0.0.0.0 192.168.94.33
ip route vrf Computers 0.0.0.0 0.0.0.0 192.168.52.1
no ip http server
no ip http secure-server
!
!
ip access-list standard SNMP_HOME
permit 192.168.0.0 0.0.0.7 log
permit 192.168.52.0 0.0.0.7 log
permit 192.168.17.16 0.0.0.7 log
permit 192.168.94.32 0.0.0.15 log
deny any log
!
ip access-list extended SSH_IN
permit tcp host 192.168.52.2 any eq 22 log
permit tcp 192.168.10.0 0.0.0.255 any eq 22 log
permit tcp host 192.168.17.18 any eq 22 log
permit tcp host 192.168.0.1 any eq 22 log
permit tcp host 192.168.0.2 any eq 22 log
permit tcp host 192.168.0.3 any eq 22 log
permit tcp host 192.168.0.5 any eq 22 log
deny ip any any log
!
!
banner login ^C
W A R N I N G
THIS IS A PRIVATE COMPUTER SYSTEM.
This computer system including all related equipment, network devices
(specifically including Internet access), are provided only for
authorized used.
All computer systems may be monitored for all lawful purposes, including
to ensure that their use is authorized, for management of the system, to
facilitate protection against unauthorized access, and to verify security
procedures, survivability and operational security.
Monitoring includes active attacks by authorized personnel and their
entities to test or verify the security of the system. During monitoring,
information may be examined, recorded, copied and used for authorized
purposes.
All information including personal information, placed on or sent over
this system may be monitored. Uses of this system, authorized or
unauthorized, constitutes consent to monitoring of this system.
Unauthorized use may subject you to criminal prosecution. Evidence of
any such unauthorized use collected during monitoring may be used for
administrative, criminal or other adverse action. Use of this system
constitutes consent to monitoring for these purposes.
^C
!
line con 0
session-timeout 60
exec-timeout 60 0
logging synchronous
login local
line vty 0 4
access-class SSH_IN in
login local
line vty 5 15
access-class SSH_IN in
login local
!
ntp clock-period 36028664
ntp server 198.60.73.8
ntp server 13.85.70.43
event manager environment suspend_ports_config flash:/susp_ports.dat
event manager environment suspend_ports_days 7
event manager directory user policy "flash:/policies/"
event manager session cli username "stw"
event manager policy sl_suspend_ports.tcl
event manager policy tm_suspend_ports.tcl
event manager applet SaveRunConfig
event timer cron cron-entry "0 0 * * *"
action 1.0 cli command "enable"
action 2.0 cli command "write memory"
!
event manager history size events 50

Router config:

version 15.1
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname LAN_Router_1
!
boot-start-marker
boot-end-marker
!
!
enable secret ************
!
no aaa new-model
!
clock timezone CST -6 0
no network-clock-participate slot 3
!
dot11 syslog
no ip source-route
!
ip vrf Computers
rd 25:1
route-target export 25:1
route-target import 71:1
!
ip vrf MGMT
rd 10:1
!
ip vrf Servers
rd 71:1
route-target export 71:1
route-target import 25:1
route-target import 49:1
!
ip vrf Wi-Fi
rd 49:1
route-target export 49:1
route-target import 71:1
!
ip cef
!
!
!
!
ip domain name MyTestLab.com
ip name-server 192.168.17.19
ip name-server 8.8.8.8
ip name-server 8.8.4.4
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
voice-card 0
!
!
!
!
!
!
!
crypto pki token default removal timeout 0
!
!
!
!
license udi pid CISCO3845-MB sn FOC105013BA
username stw privilege 15 secret ******************
!
redundancy
!
!
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh logging events
ip ssh version 2
!
!
!
!
!
!
!
!
interface Loopback25424
ip vrf forwarding Computers
ip address 192.168.254.24 255.255.255.255
!
interface Loopback25448
ip vrf forwarding Wi-Fi
ip address 192.168.254.48 255.255.255.255
!
interface Loopback25470
ip vrf forwarding Servers
ip address 192.168.254.70 255.255.255.255
!
interface Loopback254009
ip vrf forwarding MGMT
ip address 192.168.254.9 255.255.255.255
!
interface GigabitEthernet0/0
ip address dhcp
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
media-type rj45
ipv6 address dhcp
ipv6 address autoconfig default
!
interface GigabitEthernet0/1
no ip address
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/1.5
encapsulation dot1Q 5
ip address 192.168.0.1 255.255.255.252
!
interface GigabitEthernet0/1.10
encapsulation dot1Q 10
ip vrf forwarding MGMT
ip address 192.168.0.1 255.255.255.252
!
interface GigabitEthernet0/1.25
encapsulation dot1Q 25
ip vrf forwarding Computers
ip address 192.168.52.1 255.255.255.248
ip helper-address vrf Servers 192.168.17.19
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1.49
encapsulation dot1Q 49
ip vrf forwarding Wi-Fi
ip address 192.168.94.33 255.255.255.240
ip helper-address vrf Servers 192.168.17.19
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/1.71
encapsulation dot1Q 71
ip vrf forwarding Servers
ip address 192.168.17.17 255.255.255.248
ip nat inside
ip virtual-reassembly in
!
router ospf 10 vrf MGMT
router-id 192.168.254.9
network 192.168.0.0 0.0.0.3 area 0
network 192.168.254.9 0.0.0.0 area 0
!
router ospf 25 vrf Computers
router-id 192.168.254.24
network 192.168.52.0 0.0.0.7 area 0
network 192.168.254.24 0.0.0.0 area 0
!
router ospf 49 vrf Wi-Fi
router-id 192.168.254.48
network 192.168.94.32 0.0.0.15 area 0
network 192.168.254.48 0.0.0.0 area 0
!
router ospf 71 vrf Servers
router-id 192.168.254.70
network 192.168.17.16 0.0.0.7 area 0
network 192.168.254.70 0.0.0.0 area 0
!
router ospf 5
router-id 192.168.254.1
network 192.168.0.1 0.0.0.0 area 1
network 192.168.254.1 0.0.0.0 area 0
!
router bgp 25
bgp log-neighbor-changes
!
address-family ipv4 vrf Computers
redistribute connected
exit-address-family
!
address-family ipv4 vrf Servers
redistribute connected
exit-address-family
!
address-family ipv4 vrf Wi-Fi
redistribute connected
exit-address-family
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip flow-capture packet-length
ip flow-capture ttl
ip flow-capture vlan-id
ip flow-capture icmp
ip flow-capture ip-id
ip flow-capture mac-addresses
ip flow-export version 9
ip flow-top-talkers
top 25
sort-by bytes
!
ip nat inside source list 10 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 dhcp
ip route 192.168.52.0 255.255.255.248 GigabitEthernet0/0 dhcp
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 dhcp
!
ip access-list standard SNMP_HOME
permit 192.168.0.0 0.0.0.7 log
permit 192.168.52.0 0.0.0.7 log
permit 192.168.94.32 0.0.0.15 log
deny any log
!
ip access-list extended SSH_IN
permit tcp host 192.168.52.2 any eq 22 log
permit tcp 192.168.10.0 0.0.0.255 any eq 22 log
permit tcp host 192.168.0.1 any eq 22 log
permit tcp host 192.168.0.2 any eq 22 log
permit tcp host 192.168.0.3 any eq 22 log
permit tcp host 192.168.0.5 any eq 22 log
deny ip any any log
!
access-list 10 permit 192.168.0.0 0.0.0.7
access-list 10 permit 192.168.52.0 0.0.0.7
access-list 10 permit 192.168.94.32 0.0.0.15
access-list 10 permit 192.168.17.16 0.0.0.7
!
!
!
!
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
banner login ^C
W A R N I N G

THIS IS A PRIVATE COMPUTER SYSTEM.

This computer system including all related equipment, network devices
(specifically including Internet access), are provided only for
authorized used.

All computer systems may be monitored for all lawful purposes, including
to ensure that their use is authorized, for management of the system, to
facilitate protection against unauthorized access, and to verify security
procedures, survivability and operational security.

Monitoring includes active attacks by authorized personnel and their
entities to test or verify the security of the system. During monitoring,
information may be examined, recorded, copied and used for authorized
purposes.

All information including personal information, placed on or sent over
this system may be monitored. Uses of this system, authorized or
unauthorized, constitutes consent to monitoring of this system.

Unauthorized use may subject you to criminal prosecution. Evidence of
any such unauthorized use collected during monitoring may be used for
administrative, criminal or other adverse action. Use of this system
constitutes consent to monitoring for these purposes.
^C
!
line con 0
logging synchronous
login local
line aux 0
line vty 0
access-class SSH_IN in
logging synchronous
login local
transport input ssh
transport output ssh
line vty 1 4
access-class SSH_IN in
login local
transport input ssh
transport output ssh
!
scheduler allocate 20000 1000
ntp server 198.60.73.8
ntp server 13.85.70.43
event manager applet SaveRunConfig
event timer cron cron-entry "0 0 * * *"
action 1.0 cli command "enable"
action 2.0 cli command "write memory"
!
end

Mark Malone · ‎12-01-2016

Hi sorry slow reply bad week in work , try add the redistribute ospf to the router too , the issue is with the redistribution and how the route is been seen

router

address-family ipv4 vrf Servers
redistribute connected
exit-address-family

switch

address-family ipv4 vrf Servers
redistribute connected
redistribute ospf 71 vrf Servers
no synchronization
exit-address-family

Shawnw4401 · ‎12-02-2016

Mark,

It's alright. I understand. It's been a rough week between work and school for me too. I don't quite understand this. I had turned off my test lab the other day, with all the configuration saved from when I sent it to you. I turned on all the equipment today and without making any configuration changes... I was able to ping everything??? Doesn't quite make sense to me.

Mark Malone · ‎12-05-2016

Hi It should have worked before as you were redistributing connected and both interfaces were connected direct to the switch , sometimes with BGP you need to clear the process if you have been making multiple changes clear bgp * (never use this in the real world but handy for labs) in real world you use soft reset