4

If VRF is implemented for routing table separation such as having an overlay network for a guest network that doesn't mix with regular LAN routing, is migrating to it easily done on Cisco switches (4500 and 6500)? Please enumerate the high-level steps.

Must all commands such as "show ip route" include the VRF name or does that same command work and just shows the default VRF?

It is possible to rollback VRF easily? What concerns are there rolling forward or back -- any downtime expected?

IGP is OSPF if this makes a difference.

Improve this question

2 Answers 2

Reset to default
5

Using VRFs is easy but depending on the size of your topology can get messy if you only deploy VRF lite. VRF lite is the use of VRFs without using MPLS. If you don't have MPLS you need to run your IGP (OSPF) in vrf aware mode. So for every switch that you have you need to create an interface in the VRF that is used for peering OSPF with the other switches. So say that you have a topology like:

               +--------+         +--------+
               |        |         |        |
    +---------+|  SW2   +--------+|  SW3   +----------------+
    |          +--------+         +--------+                |
    |                                                       |
    |                                                       |
+---+---+                                              +----+---+
|       |                                              |        |
| SW1   |                                              |  SW4   |
+-------+                                              +--------+

So now the basic steps to move over to a VRF is to first create the VRF:

ip vrf Guest
rd 1:1

Then you need to have a L3 interface between the switches. Are you running L2 links today with SVI or do you have "real" L3 interaces? If you are using SVI it would be:

int vlan 12
ip vrf forwarding Guest
ip add 12.12.12.1 255.255.255.0
!
int vlan 23
ip vrf forwarding Guest 
ip add 23.23.23.2 255.255.255.0

If you are moving these IP addresses from the global table then there will be a disruption because when you move it to a VRF all your routing state will be cleared because at that point the VRF is empty.

Then you need to configure your IGP:

router ospf 1 vrf Guest
net 12.12.12.0 0.0.0.255 area 0
net 23.23.23.0 0.0.0.255 area 0

OSPF does not support having multiple VRFs under the same process number so you would need to run a new process number.

All show commands will use vrf to check the status like:

show ip route vrf Guest
show ip cef vrf Guest
ping vrf Guest x.x.x.x
Improve this answer
8
  • I was hoping you'd reply. Do all switches have to partake in VRF? (I would guess yes if the links between them run a dynamic routing protocol for each VRF). How do you roll out VRF slowly across the switches without impacting the existing OSPF area or is that unavoidable? Most links are L2 SVI (VLANs) in the access and distribution layers with L3 (routed) interfaces between dist and core.
    – generalnetworkerror
    Commented May 30, 2013 at 7:29
  • Switch needs to participate in OSPF if it has users in VRF or is transit device. If it is neither then it's not neccessary to run OSPF. As you would run OSPF in new process it should not disturb your main process. For minimal downtime you could deploy some test network running in the VRF. Check that everything is working and then switch over to using the real IPs. You could start with adding transit links, SVI or routed(dot1Q) and verify basic connectivity between switches.
    – Daniel Dib
    Commented May 30, 2013 at 7:36
  • And lastly, if my goal is really just to create a separate Guest routing layer where most routing for it just has a default route going towards the Internet, would you just leave everything else in the default VRF? What happens to the existing OSPF areas when you enable VRF routing? Can you mention possible roll-back of VRF to complete the answer to the questions?
    – generalnetworkerror
    Commented May 30, 2013 at 7:38
  • @DanieldDib, I have an answer award to give you if you can answer my question on the rollback.
    – generalnetworkerror
    Commented Jun 5, 2013 at 3:15
  • Then I would leave everything else in the default VRF. Some like to put management in a VRF but that requires that all services you use support VRF config and you have to use VRF aware commands to telnet/tracerout etc. Existing OSPF should not be affected since you run VRF in new process. In my lab I tested adding VRF and it didn't affect my existing OSPF. Always be careful though. Rollback should be easy and only affect Guest network. I suggest you prepare rollback configuration so you have it read if needed.
    – Daniel Dib
    Commented Jun 5, 2013 at 5:39
3

Creating a VRF is easy enough as is assigning interfaces to a VRF. Assigning an interface to a VRF though will remove all L3 addressing on that interface so there will be downtime if that interface is currently passing traffic.

You will also need to configure VRF aware IGP instances (assuming you are currently running an IGP in your topology now) to route traffic where it needs to go.

Yes, commands that show vrf specific info must include the vrf name. commands that don't include the vrf name will show you info from the default (global) VRF.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.