Internet routes - Global or VRF

Hi. We are implementing an upgrade to a MPLS-VPN Core. We are doing this for a Telco Service Provider which also has Internet offering. We are deciding whether to put the full internet routes in a VRF or into the global roouting table.
Can anyone give us the pros and cons on this dilemma?
Initially, our design was to put the Internet in a VRF. The MPLS-VPN is intended to be a multiservice core offering eventually VOIP, VPLS , eoMPLS, etc. The core consists of GSR12406 P routers, 7606sUP720 PE, and 7200-NPEG1 PEs.
Thanks.
bing

Hi, thanks for the response. I have additional questions.
1. would there be any security issue when i have full internet routes in my global routing table while i have VPN customer ( i.e. EoMPLS, L3VPN ) in my VRFs?
2. When i use CSC - this means that my "Internet" becomes my Customer Carrier (ISP) although this is really owned by the same company. I would have to use BGP between the PE and the CE ( Internet routers) for scalability. I need this because i need to use the PE to participate in BGP routing, since we own this anyway. This would mean that i would have Internet routes ( whether full or selective routes) in my "Internet" VRF. is this understanding correct?
3. related to #2, if i use CSC and i have 2 Internet PoPs belonging to the same AS number which traverses a CSC, i would have to use AS-override functionality. ( e.g. if my Internet AS is 100, and my CSC AS number is 300, i would have to traverse this path: PoP#1 AS100 - AS300 - PoP#2 AS100). When i do a traceroute, i will see AS300 as part of the path. Would there be a way to hide the AS number of the CSC? - so that it will not appear in the traceroute.
Thanks.
Bing

Similar Messages

Full internet routes in MPLS-VRF

hi~ all
I just have some confused , whether it's good way load full internet routes in MPLS VRF , which there's no any service routing in core network but topology routing . but there's dual upstream ISP connecting ASBR , I'm afraid if I load these two full internet routes into VRF on 7600 , is it possible ? does it take so long time for loading routes in VRF ?
could someone give me some proposal about it or some experience about internet routes in VRF , thanks.

Its not a good practise to load all the internet rouetes in the vrf. Do use vrf leaking. For this create a vrf of named internet which will be loaded with the default route and export that route with the rd and mport that route in your particular vrf. With this you will be having only 1 route in the vrf.
regards
shivlu

Trouble getting internet route table distributet in a VRF

Hi every one ..
I'm have some trouble getting distributed the internet routing table between PE routers ...
CE1 og PE1 works fine, BGP routes all internet routes are shown i en route table, but distributing between PE1 and PE2 is now working .. any one having a clue !!.
My gold is to move internet access into it's oven VRF, and away from the global routing table
In the MPLS core aim running the same AS number as our official AS, that we use for peering to the internet..
snap of configurations
***CE1***
router bgp 65534
neighbor 172.31.61.55 remote-as 65534
neighbor 172.31.61.55 description PE-1
neighbor 172.31.61.55 shutdown
neighbor 172.31.61.55 update-source Loopback0
neighbor 172.31.61.55 next-hop-self
***MPLS PE1***
ip vrf NET-INTERNET
rd 65534:10051
route-target export 65534:10051
route-target import 65534:10051
interface Port-channel1.35
encapsulation dot1Q 35
ip vrf forwarding NET-INTERNET
ip address 172.31.61.55 255.255.255.224
mpls label protocol ldp
tag-switching mtu 1546
tag-switching ip
router bgp 65534
neighbor 192.168.0.146 remote-as 65534
neighbor 192.168.0.146 description PE2
neighbor 192.168.0.146 update-source Loopback0
neighbor 192.168.0.146 version 4
neighbor 192.168.0.146 next-hop-self
address-family vpnv4
neighbor 192.168.0.146 activate
neighbor 192.168.0.146 send-community both
exit-address-family
address-family ipv4 vrf NET-INTERNET
neighbor 172.31.1.2 remote-as 65534
neighbor 172.31.1.2 activate
neighbor 172.31.1.2 description CE1
no auto-summary
no synchronization
exit-address-family
***MPLS PE2***
ip vrf NET-INTERNET
rd 65534:10051
route-target export 65534:10051
route-target import 65534:10051
interface Port-channel1.67
encapsulation dot1Q 67
ip vrf forwarding NET-INTERNET
ip address 172.31.254.1 255.255.255.252
mpls label protocol ldp
tag-switching mtu 1546
tag-switching ip
router bgp 65534
neighbor 192.168.0.132 remote-as 65534
neighbor 192.168.0.132 description PE1
neighbor 192.168.0.132 update-source Loopback0
neighbor 192.168.0.132 version 4
address-family ipv4 vrf NET-INTERNET
neighbor 172.31.254.2 remote-as 65534
neighbor 172.31.254.2 activate
Best regards
/Peter

For VPN routes to be exchanged between the two PEs, you first need to configure VPNv4 address family on each one of the PEs.
Carrying the full Internet routing table over VPNv4 will work but it is not very scalable since all PE routers have to hold the full Internet routing table in the VRF context in addition to potentially full Internet routing table in the global routing table. If you want to exchange full Internet routing table between the two CEs, it would be preferable to use something Carrier Supporting Carrier (CSC).
Please refer to the following URL for additional information on CSC:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120limit/120s/120s23/fscscl23.htm
Hope this helps,

Route leaking from VRF to Global on same router with VLAN interface

Hi all,
I would like to do some route leaking from VRF to Global and Global to VRF on the same router. Here is an output of the config:
interface FastEthernet4
description ***Connection to WAN***
ip vrf forwarding FVRF
ip address 10.0.0.6 255.255.255.0
interface Vlan100
description ***LAN***
ip address 192.168.227.1 255.255.255.0
So what I want is to import 192.168.227.0 /24 into FVRF and import 10.0.0.0 /24 into the global routing table.
I though I could do that config but it is not possible:
(config)#ip route vrf FVRF 192.168.227.0 255.255.255.0 vlan 100
% For VPN or topology routes, must specify a next hop IP address if not a point-to-point interface
OR
DK-SLVPN(config)#ip route vrf FVRF 192.168.227.0 255.255.255.0 vlan 100 192.168.227.1 global
%Invalid next hop address (it's this router)
Any ideas are really welcome.
Best regards,
Laurent

Hi,
I have tried the following solution:
Add 10.0.0.0 /24 From VRFto Global:
ip route 10.0.0.0 255.255.255.0 FastEthernet4
Add 192.168.227.0 /24 from Global to VRF:
router bgp 64512
bgp log-neighbor-changes
address-family ipv4
no synchronization
redistribute connected
no auto-summary
exit-address-family
ip prefix-list Global-VRF seq 5 permit 192.168.227.0/24
route-map Global permit 10
match ip address prefix-list Global-VRF
ip vrf FVRF
rd 1:1
import ipv4 unicast map Global
So now the VRF table looks like that:
#      sh ip route vrf FVRF
C        10.0.0.0/24 is directly connected, FastEthernet4
S        10.0.0.1/32 [254/0] via 10.0.0.1, FastEthernet4
L        10.0.0.6/32 is directly connected, FastEthernet4
B     192.168.227.0/24 is directly connected, 00:15:12, Vlan100
The Global table looks like this:
#sh ip route
Gateway of last resort is 10.1.0.107 to network 0.0.0.0
D*    0.0.0.0/0 [90/1709056] via 10.1.0.107, 3d02h, Tunnel1
       10.0.0.0/8 is variably subnetted, 8 subnets, 2 masks
S        10.0.0.0/24 is directly connected, FastEthernet4
C        10.1.0.0/24 is directly connected, Tunnel1
L        10.1.0.227/32 is directly connected, Tunnel1
C        10.2.0.0/24 is directly connected, Tunnel2
L        10.2.0.227/32 is directly connected, Tunnel2
C        10.10.10.227/32 is directly connected, Loopback100
       192.168.227.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.227.0/24 is directly connected, Vlan100
L        192.168.227.1/32 is directly connected, Vlan100
But When I try to ping it still doesn´t work:
#ping vrf FVRF 192.168.227.1 source fastEthernet 4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.227.1, timeout is 2 seconds:
Packet sent with a source address of 10.0.0.6
Success rate is 0 percent (0/5)
#ping 10.0.0.1 source vlan 100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.227.1
Success rate is 0 percent (0/5)
Any ideas?
Regards,
Laurent

The growth of the internet routing table + LISP

I have been challenged with the task of putting together a 15-20 minute presentation of how I might go about solving the problem of the growth of the internet routing table.
If I am understanding the question correctly - as the internet grows so will the number of IPv4 and (moreso) IPv6 prefixes that appear in the global internet routing table. This will mean that the PE and P routers in a Service Provider network will find themselves having to deal with more prefixes that will in turn increase the possibility of bogons interferring with proper routing and increase the load on the routers themselves.
Besides being a very open ended question, I am trying to look at it from the perspective of a Service Provider (whom I work for) and have come up with the following options (admittedly this is only after a quick google on the topic):
> Improvise in the short term by adjusting CAM table allocation
> Use selective hearing by filtering prefixes that are not important
> Use external assistance like LISP and DNS
> Spend Money and upgrading existing routers to handle the load
Obviously with only a 20 minute window I cannot talk about much and I would like the options to be innnovative and interesting. LISP seems like an interesting option and I would like to learn about it - however I am having trouble tracking down resources that give a basic introduction to exactly what and how LISP works (every time I try and search for it a get pushed to sites talking about the programming language ).
So this leads me to two questions:
1. Is there anything important, vital or interesting that I have not included in my quickly put together list above.
2. Is anyone aware for a good site/resource that explains LISP from a beginners/tutorial-type perspective.

I have been challenged with the task of putting together a 15-20 minute presentation of how I might go about solving the problem of the growth of the internet routing table.
If I am understanding the question correctly - as the internet grows so will the number of IPv4 and (moreso) IPv6 prefixes that appear in the global internet routing table. This will mean that the PE and P routers in a Service Provider network will find themselves having to deal with more prefixes that will in turn increase the possibility of bogons interferring with proper routing and increase the load on the routers themselves.
Besides being a very open ended question, I am trying to look at it from the perspective of a Service Provider (whom I work for) and have come up with the following options (admittedly this is only after a quick google on the topic):
> Improvise in the short term by adjusting CAM table allocation
> Use selective hearing by filtering prefixes that are not important
> Use external assistance like LISP and DNS
> Spend Money and upgrading existing routers to handle the load
Obviously with only a 20 minute window I cannot talk about much and I would like the options to be innnovative and interesting. LISP seems like an interesting option and I would like to learn about it - however I am having trouble tracking down resources that give a basic introduction to exactly what and how LISP works (every time I try and search for it a get pushed to sites talking about the programming language ).
So this leads me to two questions:
1. Is there anything important, vital or interesting that I have not included in my quickly put together list above.
2. Is anyone aware for a good site/resource that explains LISP from a beginners/tutorial-type perspective.

Internet Connectivity for Multi - vrfs

Hi all,
Some help needed with the scenario below;
Am currently migrating our legacy IP network to MPLS.we have been able to migrate 3 seperate networks into their respective vrfs and currently only left with the internet segment which used to connect to these 3 networks via a Cisco 535 firewall.
Problem is, i have created an internet vrf and intend to export a default route within the internet vrf into the other vrfs.Which should work fine for traffic leaving these networks to the internet.
Problem is : how to handle traffic comming from the internet to these respective vrfs without having to import those routes into the internet vrf?
Why do i want this ? Currently inter-vrf traffic is via a FWSM only and would like to keep it that way. No leaking of routes from one vrf to the other.If i do import the 3 vrfs into the internet vrf, it will leak one vrf route to the other !
Any help ?

Well,
one way would be to create a VLAN subinterface per VRF in the PIX. This way all traffic to the internet would be directed towards the firewall and there you could easily control/block inter-VRF traffic.
Or you create one internet interface in the FWSM and control access there.
Regards, Martin

Inject BGP Default Routes into Multiple VRF before Best Path Selection

Hello,
I have the following setup:
Multiple Border Routers with eBGP sessions to external AS. We receive a default route from this multiple AS to keep the Table manageable. We noticed an important part of our traffic was been SW routed instead of CEF when we had the Full Internet table. Router Resources came to the ground when we changed to a default.
Now I want to separate this default routes into different VRF. Attached is the Diagram.
My question is, the multiple default route all go into the BGP Table. The BGP table then select the best route and place it on the RIB and then to the FIB.
I want to redistribute the different Route on the BGP table prior to the Best path selection algorithm and placed on the RIB.
How can I achieve this?

Hi,
Redistribution of multiple routes to same prefix is not possible. Even if you have configured BGP multipath and all different bgp routes got installed into routing table, during redistribution only route will be redistributed.
Also would like to understand the requirement of redistributing multiple BGP routes in to IGP. As per your diagram, 3 different eBGP sessions are on three different routers, so you can prefer eBGP route over iBGP received from other routers and can distribute eBGP route to IGP from each router. Thus you will have three different default routes in to IGP in core.
Please don't forget to rate this post if it has been helpful
- Akash

Full internet routing in an internet MPLS VPN

Is it possible and advisable to run the full internet routing table in a seperate MPLS VRF. A default route is not an option
With kind regards,
Mike

Hi,
It is not advisable to have full Internet Routing table in a vrf.It is possible that you may run out of memory since different routers have different vrf routes holding capacity.e.g if you are using 12000 series and you have only one vrf configured then you can hold the entire Internet routing table in one vrf.
Which router you have ? Is it 12000 ?How many vrfs you have ? How many routes have you per vrf ?
You need to consider the above questions before making the decision.
-Waris

Migrating Interface from Global to VRF

Hi All,
We are trying to move interfaces from global routing table to VRF interface and during that process we are trying to move eigrp belonging to that interface from Global configuration to Address-family ipv4 instance of the eigrp under the VRF .
We are trying to figure out to populate passive-interface command under the address-family ipv4 vrf .But couldn't find the command supported in 12.2(18)SXF15 for Cisco 7600 router. Do we have to configure the passive-interface command alone in the global eigrp instead of address-family ?. Any help would be really appreciated.
Thanks
Regards
Anantha Subramanian Natarajan

Anantha,
"passive-interface" under the "address-family" is only available starting with 12.2(33)SRB.
In the version you are currently running, configuring "passive-interface" globally will take effect even for specific VRF interfaces though.
Regards

BGP Session drops when loading routes into a VRF

I've configured a small MPLS network with 4 P routers (ASR 1002s) 4 PE routers (6509s) and two Cisco 7206s as route reflectors. I'm using OSPF as the routing protocol on the PE-CE interfaces and have sham links configured between PE routers. I currently have two VRFs configured on this network, one is working fine, and there are approximately 150 routes in this VRF.
The second vrf is configured, it also has ospf sham links configured, neighbors up, etc.
The problem I have is that when I bring up the first PE-CE link and load about 7000 routes into the second vrf my BGP sessions between the other PEs and route-reflectors start timing out. I do show the vpnv4 routes show up in the route-reflectors "sh ip bgp vpnv4 rd 14017:2" I believe the debug outputs below indicate the issue is in the route-reflectors, but was curious if anyone else had seen this issue. The BGP peering IP address for one of the route-reflectors is 10.2.0.7 and one of the session dropping PEs is 10.2.0.13.
Normal output from "unloaded" debug ip bgp vpnv4 unicast keepalives:
Route-reflector output:
May 16 09:35:31   2329: May 16 09:35:30.718 CDT: BGP: ses global 10.2.0.13 (0xA0519C0:1) Keep alive timer fired.
May 16 09:35:31   2330: May 16 09:35:30.718 CDT: BGP: 10.2.0.13 KEEPALIVE requested (bgp_keepalive_timer_expired)
May 16 09:35:31   2331: May 16 09:35:30.718 CDT: BGP: ses global 10.2.0.13 (0xA0519C0:1) service keepalive IO request.
May 16 09:35:31   2332: May 16 09:35:30.718 CDT: BGP: 10.2.0.13 KEEPALIVE write request serviced in BGP_IO
PE output:
May 16 09:35:38.421 CDT: BGP: 10.2.0.7 KEEPALIVE requested (bgp_keepalive_timer_expired)
May 16 09:35:38.421 CDT: BGP: 10.2.0.7 KEEPALIVE sent
Route-reflector output:
May 16 09:35:39   2341: May 16 09:35:38.427 CDT: BGP: 10.2.0.13 received KEEPALIVE, length (excl. header) 0
Same output but during a "loaded" condition:
Route-reflector output:
May 15 20:41:31   774: May 15 20:41:31.015 CDT: BGP: ses global 10.2.0.13 (0xA091324:1) Keep alive timer fired.
May 15 20:41:31   775: May 15 20:41:31.015 CDT: BGP: 10.2.0.13 KEEPALIVE requested (bgp_keepalive_timer_expired)
May 15 20:41:31   778: May 15 20:41:31.015 CDT: BGP: ses global 10.2.0.13 (0xA091324:1) service keepalive IO request.
May 15 20:42:29   793: May 15 20:42:28.363 CDT: BGP: ses global 10.2.0.13 (0xA091324:1) Keep alive timer fired.
May 15 20:42:29   794: May 15 20:42:28.363 CDT: BGP: 10.2.0.13 KEEPALIVE requested (bgp_keepalive_timer_expired)
May 15 20:43:23   805: May 15 20:43:22.638 CDT: BGP: ses global 10.2.0.13 (0xA091324:1) Keep alive timer fired.
May 15 20:43:23   806: May 15 20:43:22.638 CDT: BGP: 10.2.0.13 KEEPALIVE requested (bgp_keepalive_timer_expired)
May 15 20:43:33   813: May 15 20:43:33.934 CDT: %BGP-3-NOTIFICATION: received from neighbor 10.2.0.13 4/0 (hold time expired) 0 bytes
PE output:
May 15 20:43:33.927 CDT: %BGP-3-NOTIFICATION: sent to neighbor 10.2.0.7 4/0 (hold time expired) 0 bytes
May 15 20:43:33.927 CDT: %BGP-5-ADJCHANGE: neighbor 10.2.0.7 Down BGP Notification sent
Route-reflector output:
May 15 20:43:34   814: May 15 20:43:33.934 CDT: %BGP-5-ADJCHANGE: neighbor 10.2.0.13 Down BGP Notification received
It appears to me that we are missing "BGP: 10.2.0.13 KEEPALIVE write request serviced in BGP_IO"
For full disclosure there are other BGP keep-alive events going on to the other PEs at this time, some passing, some failing.
route-reflector info:
route-reflector1#sh inv
NAME: "Chassis", DESCR: "Cisco 7206VXR, 6-slot chassis"
PID: CISCO7206VXR      , VID:    , SN: 37050753
NAME: "NPE-G2 0", DESCR: "Cisco 7200 Series Network Processing Engine NPE-G2"
PID: NPE-G2            , VID: V03 , SN: JAF1410AADM
NAME: "disk2", DESCR: "256MB Compact Flash Disk for NPE-G2"
PID: MEM-NPE-G2-FLD256 , VID:    , SN:
NAME: "Power Supply 1", DESCR: "Cisco 7200 AC Power Supply"
PID: PWR-7200-AC       , VID:    , SN:
NAME: "Power Supply 2", DESCR: "Cisco 7200 AC Power Supply"
PID: PWR-7200-AC       , VID:    , SN:
route-reflector1#sh ver
Cisco IOS Software, 7200 Software (C7200P-ADVIPSERVICESK9-M), Version 15.1(4)M5, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Tue 04-Sep-12 19:41 by prod_rel_team
ROM: System Bootstrap, Version 12.4(12.2r)T, RELEASE SOFTWARE (fc1)
BOOTLDR: Cisco IOS Software, 7200 Software (C7200P-BOOT-M), Version 15.1(4)M5, RELEASE SOFTWARE (fc1)
route-reflector1 uptime is 15 weeks, 20 hours, 43 minutes
System returned to ROM by reload at 11:03:48 UTC Thu Jan 31 2013
System restarted at 12:37:52 CST Thu Jan 31 2013
System image file is "disk2:c7200p-advipservicesk9-mz.151-4.M5.bin"
Any thoughts on this problem would be greatly appreciated.

Hi again,
did you check this?
http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a008010a28a.shtml
I honestly do not remember the defaults in Cisco but I had a very similar issue working with Juniper because of this value was set @ about 4500 prefixes at once.
Take care
Alessio
Sent from Cisco Technical Support iPad App

I just set up the airport wireless modem - with a comcast internet router - all wireless device connect seemlessly (3 Iphones, Mac Air, and a Sony Laptop) but my IPAD 1 no longer connects. It tries to but never connects. I have reset it and have utility

I just set up the airport wireless modem - with a comcast internet router - all wireless device connect seemlessly (3 Iphones, Mac Air, and a Sony Laptop) but my IPAD 1 no longer connects. It tries to but never connects. I have reset it and have airprot utility app downloaded on my IPAD - it shows the modem and the internet no connected?

Do you mean an Airport Extreme Base Station connected to a Comcast Modem?

How set up macbook pro Internet router?

how set up macbook pro Internet router?

But isn't the MacBook Pro connected to the modem and being used as the router? You can only share an Ethernet connection wirelessly. You only check the box to share the Ethernet connection to Wi-Fi. Do not check any of the other boxes. You select Ethernet from the dropdown menu as the connection you will share. Your preferences should look like this:
The only difference will be that yours will show just Ethernet, not Ethernet 1.

I bught a new Time Capsule 2Tb. I connected it to my internet router. I manege to set it up as base station but when i try to use it with time machine I always get the message "Check your IP addres"? What am I doing wrong? On my computer I have OSX 10.7.5

I bought a new Time Capsule 2Tb. I connected it to my internet router. I manage to set it up as base station but when i try to use it with time machine I always get the message "Check your IP addres"? What am I doing wrong? On my computer I have OSX 10.7.5

What IP address does the TC have and what IP does the computer have?
We need more info as we really have no idea what your network looks like.
Modem router, model, type of broadband?
TC setup as bridge or router?
Is the computer getting internet via the TC?
Are you using wireless or ethernet?
Have you set IPv6 correctly to local link in the computer on whichever network client is doing the connection?
Did this work the first time for backup and has now failed? If so simply reboot the TC. It is a constant bug that the TC is lost to the network.

My AppleTV will not play anything over Air Play. Every other function works perfectly, and my Internet/router are working at top speed. I can watch HD Netflix and YouTube but nothing via my iTunes library on my MacBook or iPad. All software is updated.

Every other function works perfectly, and my Internet/router are working at top speed. I can watch HD Netflix and YouTube but nothing via my iTunes library on my MacBook or iPad. All software is updated. The AppleTV will recognize that Air Play is trying to do it's thing, but with music files it sounds like they're skipping and video files just load endlessly.

I'm searching for an answer to almost the same exact problem, using almost the same exact hardware and software. Has an answer been found?
The files that I'm trying to burn come from eMusic, and they are formatted mp3. Recently, (after the iTunes update to 9.2.3?,) they would not drag and drop from iTunes into Toast. From several different discussions I've tried working around this by dragging to the desktop first then dragging and dropping to Toast, going to Toast from a programmer's homemade help window, " iToons," and today, after talking with Apple support, going directly to Toast from my eMusic folder. Alas, all recordings do not perform like they use to. Sometimes they play and sometimes not. There is one I managed, that is listenable, but sometimes I have to put it in my car stereo over and over again as it gets ejected with an error code, sometimes, finally it takes it... Some of the recordings on other disks I've burned are not clean - they have white-noise sounds creeping in... I use to have none of these problems. One time as I was listening to a CD that managed to play, and it just stopped playing... Is there an answer out there to get back to how it use to be? Thanks for you help.

What is the best internet router out there

i am looking into get a new wireless internet router for my home, i want one that will have a strong signal and that can go a fair distance. any sugestions?

You want to have other suggestions besides Airport Extreme? Well, depends how much money you want to put, Cisco E4200V2 has been quite good and surprisingly good range.
If you want to put even more money into wireless, you can get very high quality and powerful Access Points from Ruckus, but honestly pretty much all higher end corporate access points are as powerful.
Message was edited by: Hyugafe

Internet routes - Global or VRF

Similar Messages

Maybe you are looking for