Dot1q Trunk between VRF Lite L3 CE and PE

[mmelbourne]

When using a trunk between a VRF-Lite L3 switch CE to multiplex VRFs onto the same access circuit, do the dot1q subinterface identifiers need to be unique? The trunk just carries multiple routed pt-pt (/30 links) in different VRFs.

For example, on the PE:

interface FastEthernet0/0.100

encapsulation dot1q 100

ip vrf forwarding RED

ip address 1.1.1.1 255.255.255.252

!

interface FastEthernet0/0.101

encapsulation dot1q 101

ip vrf forwarding GREEN

ip address 2.2.2.1 255.255.255.252

Since the subinterface identifiers (100 and 101) are only locally significant for the trunk, can they be reused on another access circuit?

[Giuseppe Larosa]

Hello Matthew,

your understanding is correct you can reuse them on another physical interface(s) of the same router

Hope to help

Giuseppe

[mmelbourne]

Is there any difference with the PE being a switch (Cat6k with Sup720-3B) rather than a router? I have seen a configuration where the sub-interfaces are unique for different access circuits, and wondered why.

[Giuseppe Larosa]

Hello Matthew,

if you use as VRF access links logical SVI they must be different.

So you can expect to use different vlan-ids for different VRFs

Be aware that there are practical limits to the max numbers of L3 interfaces on a C6500 with sup720 that are less then 4096 (the 802.1Q vlan space)

Inside a C6500 exist the L2 vlan so here it's better to avoid to reuse the same vlan-id towards different customers

Hope to help

Giuseppe

[mmelbourne]

Thanks for that. Given the following L3 sub-interface on a C6500:

interface FastEthernet0/0.100

no switchport

encapsulation dot1q 100

ip vrf forwarding RED

ip address 1.1.1.1 255.255.255.252

Would this use the internal vlan-id 100, which then couldn't be used elsewhere, or is it possible to re-use it within the same VRF? The SVI "int vlan 100" is not configured. The access links connect to switches (running L3 routing), and utilise VRF-lite to separate the routing tables.

[Giuseppe Larosa]

Hello Matthew,

in a multilayer switch exists the L2 broadcast domain Vlan 100 (access ports in vlan 100 and trunk ports with enc 802.1Q 100 are in the same broadcaast domain) and in when configured and used can exist the SVI Vlan that acts at layer 3.

A routed interface like

int gi2/1

no switchport

ip address 10.1.2.1 255.255.255.0

!

this is not associated to any vlan but I think that your configuration can create the L2 object Vlan 100 and so in this case a second port in vlan100 will be able to communicate with this first interface

So I would avoid to use the same vlan-id on a multilayer switch

Hope to help

Giuseppe