vrf lite

[WILLIAM STEGMAN]

I'm trying to wrap my head around a proposed vrf lite solution our provider is offering that will allow us to have logical connections between multiple WANs hosted on 1 physical link.  The multiple WANs are all hosted by the same company.  I'll use two WANs in the example, with 2 CERs running eBGP with the provider's PERs.  Router A is one CER that has connectivity to WAN A, and router B is another CER with connectivity to WAN B.  We want the locations with Router A and Router B to be able to communicate.  So below is the config I've come up with, but am not sure if it is correct or complete.  How do I communicate the IGP learned routes, redistribute them under the BGP address family or just add network statements under the address family?  And am not sure how I can assign a vrf to the layer 3 interface of Router B since it is using ppp encapsulation on its DS3 and I can't create a subinterface.  Examples I've seen either use frame relay encapsulation or vlans with 802.1x encapsulation.

Router A

Router(config)# ip vrf A
Router(config-vrf)# rd 65030:10
Router(config-vrf)# route-target export 65030:10
Router(config-vrf)# route-target import 65000:10

int s 4/0
ppp encapsulation - how do I assign vrf?
ip vrf forwarding A
ip add x.x.x.x
frame-relay interface-dlci 800

router bgp 65030
address-family ipv4 vrf A
neighbor 192.168.0.30 remote-as 13979
neighbor 192.168.0.30 activate
no synch
no auto

Router B

Router(config)# ip vrf B
Router(config-vrf)# rd 65000:10
Router(config-vrf)# route-target export 65000:10
Router(config-vrf)# route-target import 65030:10

int s 2/0
int s 2/0.799
ip vrf forwarding B
ip add x.x.x.x
frame-relay interface-dlci 799

router bgp 65030
address-family ipv4 vrf B
neighbor 172.21.2.82 remote-as 13979
neighbor 172.21.2.82 activate
no synch
no auto

thank you,

Bill

[Mohamed Sobair]

Bill,

Its an excellent proposal to have vrf-lit on all logical connection using the same physical interface.

What I can see is your serials should have ppp or frame-relay encapsulation. and Actually with frame-relay , you could have multiple point to point links using specific DLCIs. However, with PPP , you cant have subinterfaces driven from the main interface. But you could have maultiple physical interfaces using PPP encapsulation bundled with PPP Multilink.

from the bellow output and based on your describtion, I suggest you take what I would suggest here to the provider and ask them if they can offer this solution for you as well.

-- VRF Selection Based on Source Address.  Here is the link for that:

http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/vrfselec.html

The reason I am suggesting it is because, you have ppp encapsulation on the main interface and you cant provide logical point to point subinterfaces using PPP as well.

Let us know if this would be an option,

Mohamed

[WILLIAM STEGMAN]

Mohamed, thank you, I will offer that as a solution to the provider.  Would this vrf based on source IP address config only apply to the site running PPP?  In other words, would I still use the subinterface method on the router with frame relay encapsulation to the PER, in which case does the config I posted look correct?  And how would I leak routes in and out of the BGP address family?

[WILLIAM STEGMAN]

Mohamed, i ran your suggestion by our provider, and they don't seem interested in even trying to go that route.  Instead, they suggested changing the site encapsulation to frame relay instead of ppp.  With that, could you give me an indication of how right or wrong this config would be on my CER?  We have 2 MPLS VPNs, below is an example of 2 CERs with access to both MPLS VPNs.

Router A

Router(config)# ip vrf A
Router(config-vrf)# rd 65030:10
Router(config-vrf)# route-target export 65030:10
Router(config-vrf)# route-target import 65000:10

Router(config)# ip vrf B
Router(config-vrf)# rd 65000:10
Router(config-vrf)# route-target export 65000:10
Router(config-vrf)# route-target import 65030:10

int s 4/0

int s 4/0.800
ip vrf forwarding A
ip add x.x.x.x
frame-relay interface-dlci 800

int s 4/0.799
ip vrf forwarding B
ip add x.x.x.x
frame-relay interface-dlci 799

router bgp 65030
address-family ipv4 vrf A
neighbor 192.168.0.30 remote-as 13979
neighbor 192.168.0.30 activate
no synch
no auto

address-family ipv4 vrf B
neighbor 192.168.0.30 remote-as 13979
neighbor 192.168.0.30 activate
no synch
no auto

Router B

Router(config)# ip vrf B
Router(config-vrf)# rd 65000:10
Router(config-vrf)# route-target export 65000:10
Router(config-vrf)# route-target import 65030:10

Router(config)# ip vrf A
Router(config-vrf)# rd 65030:10
Router(config-vrf)# route-target export 65030:10
Router(config-vrf)# route-target import 65000:10

int s 2/0
int s 2/0.799
ip vrf forwarding B
ip add x.x.x.x
frame-relay interface-dlci 799

int s 2/0.800
ip vrf forwarding B
ip add x.x.x.x
frame-relay interface-dlci 800

router bgp 65030
address-family ipv4 vrf B
neighbor 172.21.2.82 remote-as 13979
neighbor 172.21.2.82 activate
no synch
no auto

address-family ipv4 vrf B
neighbor 172.21.2.82 remote-as 13979
neighbor 172.21.2.82 activate
no synch
no auto

thank you,

Bill

[Chetan Kumar Ress]

Hi William

As per your senario the config will work.

I suggest you to go with same what you configured . Config  vrf in CE router will give you scalability to use any netwok address and if you go with Source base VRF selection the you have to always depend on your ISP for any changes.

You have to config little more to define which will be you Primary & Secondary path in BGP ( As you have two MPLS VPN link ) .

Regards

Chetan Kumar

http://chetanress.blogspot.com

[WILLIAM STEGMAN]

Hi Chetan.  Thank you.  Would you elaborate on what you mean by the primary and secondary path in BGP?  I was thinking the only thing I had left to do was route leaking.  Each VRF on the CE would have a unique routing table separate from the global routing table and I would leak routes between the global routing table and VRF routing tables, and potentially between VRFs.

[Chetan Kumar Ress]

Hi William

As you will be running VRF Lite over WAN with Service provider where SP will only forward you updates to other PE and youe remote location is conected to PE's

For Example  :       CE1 ----------------- PE 1----------Remote 1

                                |                         |

                            CE2 ---------------- PE 2 -------- Remote 2

Here You Can see that Between CE & PE you have Two link ( As you told you have two MPLS VPN link )

So in CE1 you will be getting both VRF route  & in CE 2 also  .You will be getting Remote 1 route in CE 1 & CE2 also, So who will be your primary path ?

So what you can do you can configure Per Link Per VRF .

VRF A ==  Path via  CE1

VRF B ==  Path via  CE2

Regards

Chetan Kumar

http://chetanress.blogspot.com

[Mohamed Sobair]

Bill,

This solution eleminate you from doing any extra configuration at your premises, all VRFs would be configured at the provider and routes would be imported based on your requirment.

You may use whatever subnets inside your Networks, you just need to tell them that I want for example the following:

1- subnet 10.x.x.x used seperate vrf

2- subnet 172.16.x.x uses seperate vrf

and whether you need full mesh connectivty between both or partial mesh depends on you, but all of this would be done at the provider site.

HTH

Mohamed