VRF lite and MPLS VRFs

We have a CE router connected to PE router. The CE router is connected via 2 links to the PE router, because we need to create two VRFs on the PE for the traffic coming from the CE to separate the traffic, so we have one vrf per link. We are running OSPF between CE and PE.. Now we need to further separate the traffic up to the CE, so Im thinking of using the VRF lite on the CE.. Can MPLS work with the VRF lite, and how to map the VRF lite VRFs on the CE to the MPLS VPN on the PE?
Is there any config examples?
Thanks in advance

VRF Lite and MPLS-VPN act independently so they can work independently. And there is no specific need for mapping. If link is for VRF A on PE so you can make it part of vrf A in CE as well. Both VRFs are independent of each other.
http://www.cisco.com/en/US/products/hw/switches/ps4324/products_configuration_guide_chapter09186a00801cddd9.html#1045190
THis document is for 4500 but logic holds the same.

Similar Messages

Vrf-Lite with MPLS requires a PE at the customer side?

Folks,
Looking at a cisco doc, which gives a sample configuration of VRF lite with MPLS (multiple customers in the same building using same MPLS cloud). My question is that how is it done in the real world. Does the provider place a PE at the customer site? cause the connection between the CE and PE has to be a link that can carry dot1Q (ethernet or fast etheret) atleast the example shows that.
Any real world experience would be highly appreciated.
Thanks,

Hi,
the customer needs no PE router installed at his site.
You can use vrf-lite (aka multi-vrf) even on a Cisco router, which does not support MPLS at all. On the CE each dot1Q subinterface can be placed in a vrf. All you need is a routing process started within the vrf being adjacent to the PE.
Example CE:
ip vrf CE-VRF1
rd 65000:1
interface FastEthernet0.100
encapsualtion dot1Q 100
ip vrf forwarding CE-VRF1
ip address 10.1.1.1 255.255.255.0
router ospf 100 vrf CE-VRF1
network 10.1.1.1 0.0.0.0 area 1
The PE would have MBGP and different RD and RTs defined, whatever is needed to setup VRFs in the provider network. Infact PE and CE each do not know about each others VRF configs at all.
VRFs on the CE define a separate IP routing context (control plane). The separation on the data plane is done via dot1Q headers (frame-relay, ATM PVC etc. would do as well) on the link between CE and PE. In an MPLS network data plane separation is done via labels.
Hope this helps
Martin

Running vrf-lite and dhcp server see 0.0.0.0 as giaddr

Im running vrf-lite and our dhcp server see only 0.0.0.0. Im able to ping vlan10, and see the dhcp request. Running on a 2811. I have limited access to device. Do I need to turn on Dhcp-relay? Verifing ip forward-protocol. Do i need to add " vrf WISP to my helper-address? The interface it sends Dhcp request is also within the vrf. The dhcp scope is part of Vlan10 subnet
int vlan 10
ip vrf forward WISP
ip add x.x.x.x s.s.s.192
ip helper-address x.x.x.x

Yes and no. It uses another interface thats within the same vrf Wisp. On the other end of the vrf it is forwarded to our global dhcp server. in bold is where the unicast packet are going using the defaultroute
int fast0/0.1
encap dot1q 1
ip vrf forwarding WISP
ip add 172.16.6.2 255.255.255.252
int vlan 10
ip vrf forward WISP
ip add 66.223.195.129 255.255.255.192
ip helper-address 208.138.129.49
ip route vrf WISP 0.0.0.0 0.0.0.0 172.16.6.1

Vrf lite and PBR on the same sub interface

Hi,
I have a connection point to point on subinterface between PE and CE and use EBGP as routing protocol. The CE are router Cisco7609 and on the subinterface i apply "ip vrf forwarding WAP". Inside this vpn / vrf that I defined before I want to do pbr, so to route the traffic based on the source Ip address. I cannot use the "vrf select" because it is not supported on this platform. So I would like to know if I can do pbr on this subinterface and how can I do it, just only configuring the "ip policy route-map WAP" under the same sub interface where I confgure ip vrf forwarding?
Thanks
Ira

Use the route map as a noraml thing.
To match the all the ip address there should not be any match statement in the route map.

CSM VRF Lite OSPF and IPSEC/GRE

We have a pretty complex vpn configuration. Its a site-to-site VRF-Lite GRE/IPSEC VPN that would be considered a point-to-point, each router is connected to two peers in a ring.
CSM complains about discovering this VPN configuration due to the VRF and the fact that OSPF with multiple OSPF processes is not supported.
My question is, can we still monitor the tunnels. We'd like to monitor the tunnels, but that seems impossible unless we can get CSM to see the tunnels which it currently is not.

VRF Lite and MPLS-VPN act independently so they can work independently. And there is no specific need for mapping. If link is for VRF A on PE so you can make it part of vrf A in CE as well. Both VRFs are independent of each other.
http://www.cisco.com/en/US/products/hw/switches/ps4324/products_configuration_guide_chapter09186a00801cddd9.html#1045190
THis document is for 4500 but logic holds the same.

AAA Authentication and VRF-Lite

Hi!
I've run into a strange problem, when using AAA Radius authentication and VRF-Lite.
The setting is as follows. A /31 linknet is setup between PE and CE (7206/g1 and C1812), where PE sub-if is a part of an MPLS VPN, and CE uses VRF-Lite to keep the local services seperated (where more than one VPN is used..).
Access to the CE, via telnet, console etc, will be authenticated by our RADIUS servers, based on the following setup:
--> Config Begins <---
aaa new-model
aa group server radius radius-auth
server x.x.4.23 auth-port 1645 acct-port 1646
server x.x.7.139 auth-port 1645 acct-port 1646
aaa authentication login default group radius-auth local
aaa authentication enable default group radius-auth enable
radius-server host x.x.4.23 auth-port 1645 acct-port 1646 key <key>
radius-server host x.x.7.139 auth-port 1645 acct-port 1646 key <key>
ip radius source-interface <outside-if> vrf 10
---> Config Ends <---
The VRF-Lite instance is configured like this:
---> Config Begins <---
ip vrf 10
rd 65001:10
---> Config Ends <---
Now - if I remove the VRF-Lite setup, and use global routing on the CE (which is okey for a single-vpn setup), the AAA/RADIUS authentication works just fine. When I enable "ip vrf forwarding 10" on the outside and inside interface, the AAA/RADIUS service is unable to reach the two defined servers.
I compared the routing table when using VRF-Lite and global routing, and they are identical. All routes are imported via BGP correctly, and the service as a whole works without problems, in other words, the AAA/RADIUS part is the only service not working.

Just wanted to help future people as some of the answers I found here were confusing.
This is all you need from the AAA perspective:
aaa new-model
aaa group server radius RADIUS-VRF-X
server-private 192.168.1.10 auth-port 1812 acct-port 1813 key 7 003632222D6E3839240475
ip vrf forwarding X
aaa authentication login default group RADIUS-VRF-X local
aaa authorization exec default group X local if-authenticated
Per VRF AAA reference:
http://www.cisco.com/c/en/us/td/docs/ios/12_2/12_2b/12_2b4/feature/guide/12b_perv.html#wp1024168

Could MPLS L3 VPN forward packet which CE configure VRF Lite?

Or does anyone have a lab for my test? Please share.
Diagram:
vrf lite - mplsl3 vpn - vrf lite
Will it have any change on mpls l3vpn configuration?
Thank you very much.

I test lab follow to this document is work. I test with static route and OSPF is work. Now, I’m testing with BGP route. I found the PE doesn’t send the BGP routes from the other sites to the CE. How should I do?
Topology:
BGP vrf lite (vrf v11) CE1 - BGP - MPLS L3VPN (vrf v1) PE1 - PE2 (vrf v1) MPLS L3VPN - BGP - CE2 (vrf v11) vrf lite BGP
PE1#sho ip rou vrf v1
Gateway of last resort is not set
B    10.0.252.1/32 [200/0] via 10.0.0.11 (nexthop in vrf default), 1d22h
B    10.0.252.2/32 [200/0] via 10.0.0.14 (nexthop in vrf default), 1d22h
L    10.0.252.3/32 is directly connected, 1d22h, Loopback101
B    38.0.0.0/24 [200/0] via 10.0.0.11 (nexthop in vrf default), 1d04h
B    39.0.0.0/24 [200/0] via 10.0.0.14 (nexthop in vrf default), 05:13:07
B    40.0.0.0/24 [200/0] via 10.0.0.11 (nexthop in vrf default), 1d04h
C    41.0.0.0/24 is directly connected, 1d22h, GigabitEthernet0/0/1/2.14
L    41.0.0.3/32 is directly connected, 1d22h, GigabitEthernet0/0/1/2.14
B    208.0.0.0/24 [200/0] via 10.0.0.11 (nexthop in vrf default), 00:06:55
B    209.0.0.0/24 [200/0] via 10.0.0.14 (nexthop in vrf default), 00:08:14
B    210.0.0.0/24 [20/0] via 41.0.0.8, 00:11:17
CE1#sho ip bgp vpnv4 vrf v11
BGP table version is 23, local router ID is 172.16.30.5
   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 800:1 (default for vrf v11)
*> 10.0.252.1/32    41.0.0.3                               0 18252 ?
*> 10.0.252.2/32    41.0.0.3                               0 18252 ?
*> 10.0.252.3/32    41.0.0.3                 0             0 18252 ?
*> 38.0.0.0/24      41.0.0.3                               0 18252 ?
*> 39.0.0.0/24      41.0.0.3                               0 18252 ?
*> 40.0.0.0/24      41.0.0.3                               0 18252 ?
r> 41.0.0.0/24      41.0.0.3                 0             0 18252 ?
*> 210.0.0.0        0.0.0.0                  0         32768 i
CE1#

MPLS / vrf-lite

Hi
We currently use a BT MPLS network and use BGP on our CE router to peer with the providers PE routers. Currently we only use one VPN for production across the MPLS network.
We are now looking to give access from some of our MPLS sites to a test environment housed in our data centre. We need to do this on a pc by pc basis.
At the moment the plan is to add a Test VPN within the MPLS network. All sites will be a member of the production VPN and those sites that also need access to test environment will be a member of the Test vpn.
This will segregate the traffic over the WAN but the issue i now have is how to segregate the traffic once it leaves the PE router. The link between the CE and PE router is just a layer 3 link so the VPN separation
has disappeared by now. I don't mind the traffic not being separated in terms of VPN's on the CE to PE link but i need to segregate the traffic once it leaves the CE router and enters our LAN.
So finally the questions
1) Is there a way to keep the separation at a VPN level on the CE -> PE link. As i say i don't mind not having it but if there is a way i would be interested.
2) More importantly i have done some limited reading on VRF-lite and was wondering before i go further if that would allow me to segregate the traffic internally within the LAN. Our Lan's in major buildings usually consist
of 4500 at the access-layer and 6500 as distribtion/core. What i would ideally like to do is ensure that only users within the site who need to access the test environment can ie. by adding a site to the TEST vpn this does
not mean that all users within the site should be able to get to it.
I could
i) Use PBR together with access-list and potentially firewalls
ii) use vrf-lite to segregate the traffic.
So is this a good application for vrf-lite or have i missed the point of it ?. if not can anyone suggest a better way ?
Many thanks
Jon

Joseph/Anantha
Thanks to both of you for your replies. If i could just query your expertise a little more.
Attached is a visio of a site that i would like to be able to access both the Test and Production VPN's. The key thing to note is that we are routing from the access-layer down to the distribution 6500 switches.
Now on the 4500 i can have 2 separate VRF's, one for the Prod VPN and one for the Test VPN. I can then assign different vlan interfaces into the relevant vrf.
Am i right in my assumptions so far ?
The problem i am having in taking this further is that a L3 interface can only be in one VRF and as the connections from the 4500 to the 6500 are L3 uplinks i can't allocate the L3 link into 2 separate vrf's (nor would it make sense to do so).
I am not in a position to change the L3 links to L2 links which would solve part of the problem as the vlan interfaces would then be on the 6500 and i could allocate these interfaces into separate VRF's.
So is there any way, bearing in mind that i need to keep L3 links from the access-layer, that i can segregate the routing tables on the 6500 and 7200 router.
If i can't do this then i don't see the advantage of trying to use VRF-lite because the 6500/7200 and 3800 will all have one routing table with both Test and Prod routes in in it and this means without route filtering these routes will get propogated by the 3800 to our remote sites.
If i have to revert to route-filtering i may as well not bother with vrf-lite ?
Jon

MPLS VRFs and DMVPN

Hello,
we try to build a DMVPN Solution and try to integrate this solution into our MPLS network.
Can anybody give me some informations about DMVPN and MPLS VRF configuration.
Thanks
Peer

Try this link, might help http://www.cisco.com/en/US/products/sw/iosswrel/ps1839/products_feature_guide09186a0080110ba1.html

VRF Lite running in the enterprise network

Hello everybody
Altough VRF lite (or Mulit VRF) seems to be a Service Provider Tecnology.
Does it make sense to use it in an Enterprise Network to isolate Networks from others ?
I cant find any design paper which describes if this would make sense.
What do you think. Is someone using it ? Does Cisco recommend it ?

Yes, VRF-lite SHOULD be used in an Enterprise environment to isolate the different security classes of devices.
In the past you would isolate different groups of users using Layer1, i.e. separate hubs either totally isolated or connected together by a router with ACLs. Since the PCs were only connected at shared 10 Mbit and the routers were such low performance and worms weren't really prevalent, this was not a big security issue at the time.
Then we migrated to VLANs, which essentially allowed Layer2 isolation within the same switch to provide the same functionality of separating different classes of users and to break up broadcast domains. Unfortunately, everyone connected the VLANs together at Layer3 with a router (or SVI) which essentially connected everything together again! And almost no one gets the ACLs right (if at all) to isolate the VLANs from each other. In fact, in most cases every VLAN can automatically reach every other VLAN from a Layer3 or IP perspective. This is a huge security problem.
Enter VRF-lite, essentially created by Cisco as their tag switching migrated to standards based MPLS and had a need to isolate Layer3 security domains from each other within the same switch (or router). Think of VLANs for routing tables. VRF stands for 'Virtual Route Forwarding', which basically means separate routing tables. Since VRF-lite is a per-switch feature (running locally to the switch) you will need to use other technologies to connect multiple VRF-lite switches together and keep the traffic isolated, see below.
What makes this so secure is that there is no command within the switch to connect different VRFs together within the same switch. You would need to connect a cable between two ports on the same switch configured in different VRFs to be able to communicate between them (recent IOS 12.2SR allows tunnels with different source VRFs but that is a corner case). The reason for this is simple, remember the basis for VRF (and VRF-lite) is for a service provider to isolate multiple customers from each other within the same switch. Just like an ATM, Frame-Relay, SONET, or Optical switch, the command line makes it very difficult (or impossible) to accidentally connect 2 different customers together.
Think about that. Even if someone was able to get ssh enable access to your switch (you aren't running telnet anymore, right?!), they CAN'T connect 2 VRFs together with any command.
And, yes, this is highly recommended by Cisco Engineers and is actually deployed far more than you think. I have VRF-lite running on at least 10 client's networks and those are LARGE networks. VRF-lite was integrated into the environment purely to solve a Layer3 security class isolation issue. I have used Layer3 dot1q trunks on c6500 switches and tunnels to keep isolated connectivity between VRFs between switches.
In Cisco speak, VRF-lite falls under the topic of 'Path Isolation' which is combined with other features that isolate traffic within the same network such as dot1q trunking, tunneling, VPN, policy-routing, and MPLS. Do a search on Cisco's web site for 'path isolation' and you will find a bunch of info.
See the following URLs for a good start:
http://www.cisco.com/en/US/netsol/ns658/networking_solutions_design_guidances_list.html
http://www.cisco.com/en/US/netsol/ns658/netbr0900aecd804a17db.html
http://www.cisco.com/en/US/netsol/ns658/networking_solutions_white_paper0900aecd804a17c9.shtml
As always, rate all posts appropriately, particularly those that provide value and don't be shy about following up with additional questions or comments.
Good luck!

Howto control/filter traffic between VRF-(lite) using route leaking?

Hi,
does anybody know how I can control/filter the traffic between two vrf when I use route leaking or also normal route target export/import connections, maybe with an acl, in the following scenarios?
Scenario 1:
I use a normal MPLS network with several PE routers (maybe ASR series) which connect to the CE routers via OSPF. Two VPNs are configured on the PE routers and I want one of PE routers to allow/route traffic between these VPNs but especially traffic on tcp port 80 and no other ports. I'm only aware of bindung acls to logical or physical interfaces but I don't know how to do this here.
Scenario 2:
Same as scenario 1 but not the PE router will connect the VPN but a separate router-on-a -tick (e.g. 4900M) which is connected to one of the PE routers should do this job with vrf-lite and route leaking (address-family ipv4 vrf ...). Also here I want only to allow tcp port 80 between the vpns
Kind Regards,
Thorsten

Thanks.
That's what I was assuming. In my experience this solution does not scale with increasing number of vpn and inter vpn traffic via route target.
Is it correct that there is only one common acl per vpn where all rules for the communication to all other vpns are configured? Doesn't this acl become too complex and too error-prone to administrate in a real network environment? Further on in my understanding this acl has to be configured per vpn on all pe routers which have interfaces to ce routers for that vpn.
Does cisco offer software for managing this?

Should Wireless be in its own MPLS VRF?

Hi,
I already have an answer I like on this one, "YES!".
Unfortunately I don't live in Mike-land while I'm at work. I need some reference architectures or authoritative security guides that explain why this is a best-practice, (at least where MPLS VRF's are available for use).
My short list of reasons is:
- More refined segementation
- Easier standardization practices and associated documentation for tier I/IIs support staffs
- Easier to trouble-shoot when route tables are differentiated, (wireless VRF's and wired VRF's)
- Easier to observe and isolate traffic, (at firewall or router) in case of security breach
...I could go on.
Any good documentation on this out there? I can't find much.
Any help appreciated,
M.

As Malcolm says, don't partition. You have a relatively small drive and partitioning will cramp OSX which needs a lot of free disk space to run optimally. The only reason I can see to put OSX on its own partition is if you want to have multiple copies on a computer. The other reason to partition is for convenience in making backups but that's going beyond your immediate question.

Vrf-lite (extranet solution)

Hi,
I have a requirement of an extranet solution (ASP model) where many customer will be connected to a central site. The spoke sites do not talk to each other, not even through the central site. One option is to use 1 VRF at the central site and import routes from all other spokes sites (different RD and RT at the spopke sites). This has been rules out. so now my other alternative is to use multiple vrf on a single access link (ethernet in this case) between the CE and PE. I was thinking of using vrf-lite at the central site, but few concepts I am not clear about.
1) can i get away without using vrf-lite on the central site. PE configures individual vrf for each 1.q interface, but CE just uses 1.q without any vrf. For start I am going to have only two/three sites, so I can either map the subinterface to a separate LAN port or i could do .1q on a single LAN int and map it to the WAN subinterface. Maybe this is not the best solution,but I do not want to go for an unnecessary solution.
2) what are the advantages and disadvantages of using vrf-lite vs no vrf (if it is possible) in this scenario.
Attached is a diagram.
thanks,
Arana

Jon,
I am back with some reading on vrf lite. I am pasting a sample configure that I picked up from another post. I noticed that there is no 'network' statement or 'redistribute static'. My questions:
1) If I am running BGP with PE, what is the normal pratice to advertise my routers per vrf?
2) In the LAN do I run separate OSPF or EIGRP instances per VRF (per subinterface)? what is the best way?
3) If I have static route to other LAN routers then I will be using 'redistribute static' right? Do I have to be specific about which static route I should redistribute to that vrf. If not how does the router know which static route to redistribute to which vrf.
I have attached a diagram. The below sample does not map to my diagram.
frame-relay switching
interface serial0/0/0
encapsulation frame-relay
interface serial0/0/0.1 point-to-point
ip vrf forwarding A
ip address x.x.x.x x.x.x.x
frame-relay interface-dlci 100
interface serial0/0/0
encapsulation frame-relay
interface serial0/0/0.2 point-to-point
ip vrf forwarding B
ip address y.y.y.y y.y.y.y
frame-relay interface-dlci 101
And So on for further interfaces.
router bgp 1
no synchronization
bgp log-neighbor-changes
no auto-summary
address-family ipv4 vrf A
neighbor x.x.x.x remote-as x
no synchronization
exit-address-family
address-family ipv4 vrf B
neighbor y.y.y.y remote-as y
no synchronization
exit-address-family
Vikram,
As long as we all can share/learn/solve problems, it is perfectly fine. I don't think I qualify to give you any advise but here is what I have found in another post that might be of interest to you.
In your post you mentioned that you do not think you can run MP-BGP between the two switch through the FW. In another post I had got an indication that you can run LDP between two PE's using GRE tunnel. In your scenario you are going throuhg a FW and in that particular post the PEs are separated by a third service provider. So if you are open to explore this might be a solution for you.
Hope this piece of information helps.
thanks,
Arana

PBR / VRF-lite / 6500 SUP720-10G-3C

Hello.
I have to make a config with PBR in a VRF, PBR tied to an IP SLA sensor also ran into the same VRF, is there any restriction regarding this on this supervisor ?

It is supported
BTW, your IOS is at least 7 years old.
VRF-Lite Aware PBR
Cisco IOS Software Release 12.2(33)SXH1 also introduces the VRF-Lite Aware Policy Based Routing (PBR) feature, which provides the ability to configure PBR on a VPN routing/forwarding instance. This feature allows users to configure VRF on an ingress interface (VRF-Lite) and apply PBR using the Cisco Express Forwarding table for that VRF. VRF-Lite Aware PBR is supported on all Cisco Catalyst 6500 Series Supervisor Engine 720, Cisco Catalyst 6500 Supervisor Engine 32, and ME-6524 products.
link:
http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/product_bulletin_cisco_catalyst_6500_virtual_switching_system_1440.html
HTH

IP VRF-Lite

Hi,
we had a network with Cat4500 SupV as Core and Cat3750/Cat3750G (not metro!) as Distribution platform.
I'm finding out if using VRF Lite is possible to separate two entities that use the same physical network and span the whole net to have one, max. two, contact point between these entities...to implement security policy
Should this work with the platform we had or to implement a VRF network we should have had Cat6500 ???
If this not work the only solution available is to use RACL at each Distribution node where there are both entitites to separate the traffic
thanks for any help

Hello,
yes what you want to do is possible.
You will need the "multi-VRF aka VRF lite" where IP routing is performed. So in case the Cat3750 are pure Layer2 switches the VRFs are not needed there.
Think of a VRF as a sort of virtual router to which certain VLAN/ethernet interfaces are attached.
To separate two entities you would create two VRFs in the Catalyst 4500 according to "Configuring VRF-lite"
http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/products_command_reference_chapter09186a008017d03c.html#wp1062144
and also in the Catalyst 3750 along the description in "Configuring Multi-VRF CE"
http://www.cisco.com/en/US/products/hw/switches/ps5023/products_configuration_guide_chapter09186a00804764c7.html#wp1320198
Note that there has being a name change from VRF-lite to Multy-VRF. This is however exactly the same feature - afaik marketing wanted the change because it sounds better.
Did this help? Then please rate the post.
Martin

VRF lite and MPLS VRFs

Similar Messages

Maybe you are looking for