12

My knowledge of inter-VRF routing isn't the best.

I have one public IP. The public Internet and its quad 0 is on the default VRF....

Then I have a Guest_VRF and a corporate_VRF which would both need to access the Internet and point to the default gateway on the default VRF.

I can see this being done with multiple Cisco routers however I can't figure out a way that I could do this all-in-one device. I keep envisioning multiple NAT/PATs here which is just messy or using loopbacks and tunnels.

I'm focusing mainly on an ISR G1/G2 router here. Does anyone have any advice?

Improve this question

3 Answers 3

Reset to default
13

Using a VRF is like using a seperate router. If you have the same WAN IP for both VRF's, then you have to configure it twice in both WAN interfaces. If you however only use one WAN interface, you'll have to divide this interface by trunking (using VLAN's) or subinterfaces.

ex:

interface FastEthernet0.5
encapsulation dot1Q 5
ip address 1.1.1.1 255.255.255.252

Notice we do not use ip vrf forwarding, we are using the default vrf here

interface FastEthernet0.10
ip vrf forwarding wanconnection:1
encapsulation dot1Q 10
ip address 1.1.1.1 255.255.255.252 (<== this can be another IP if you prefer to divide it with 2 different IP's)

The connection then goes as follows:

  • your router (normal vrf) => wan connection => vpn used for dot1Q tag 5
  • your router (wanconnection:1 vrf) => wan connection => vpn used for dot1Q tag 10

if you want to do this without tagging and just have 2 physical interfaces, it's the same implementation:

interface FastEthernet0
ip address 1.1.1.1 255.255.255.252

interface FastEthernet1
ip vrf forwarding wanconnection:1
ip address 1.1.1.1 255.255.255.252

Every other interface needed in the specific vrf "wanconnection:1" needs to be added in the same way: 

ip vrf forwarding wanconnection:1

ex:

interface FastEthernet4
 ip vrf forwarding wanconnection:1
 ip address 10.0.0.1 255.255.255.0

making a vrf: http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/15.02SG/configuration/guide/vrf.html

ip vrf wanconnection:1
 rd 65000:1

the rd 100:1 command explained: Creates a VRF table by specifying a route distinguisher. Enter either an AS number and an arbitrary number (xxx:y) or an IP address and arbitrary number (A.B.C.D:y).

for the routing part:

ip route 0.0.0.0 0.0.0.0 1.1.1.2
ip route vrf wanconnection:1 0.0.0.0 0.0.0.0 1.1.1.2

If you only have one WAN connection without tagging enabled, you could use inter Vrf routing: http://packetlife.net/blog/2010/mar/29/inter-vrf-routing-vrf-lite/

ex:

ip vrf wanconnection:1
 rd 65000:1
 route-target export 65000:2
 route-target import 65000:99

ip vrf wanconnection:2
 rd 65000:2
 route-target export 65000:1
 route-target import 65000:99

ip vrf shared:1
 rd 65000:99
 route-target export 65000:99
 route-target import 65000:1
 route-target import 65000:2

interface FastEthernet0
ip vrf forwarding shared:1
ip address 1.1.1.1 255.255.255.252 

interface loopback1
ip vrf forwarding shared:1
ip address 2.2.2.2 255.255.255.255


ip route vrf shared:1 0.0.0.0 0.0.0.0 1.1.1.2
ip route vrf wanconnection:1 0.0.0.0 0.0.0.0 2.2.2.2
ip route vrf wanconnection:2 0.0.0.0 0.0.0.0 2.2.2.2

interface FastEthernet1
ip vrf forwarding wanconnection:1 
ip address 10.0.0.1 255.255.255.0
description "LAN interface vrf 1"

interface FastEthernet2
ip vrf forwarding wanconnection:2
ip address 10.0.2.1 255.255.255.0
description "LAN interface vrf 2"

here FastEthernet1 will use the default route for vrf wanconnection:1 and FastEthernet2 will use the default route for vrf wanconnection:2 (provided by the "ip route" commands).

Improve this answer
6
  • I think the route leaking at the end is what he OP was after without knowing it :)
    – jwbensley
    May 30, 2013 at 10:41
  • @javano I think so 2 :) but I hope I gave a bit of an overview of some of the possibilities :)
    – Bulki
    May 30, 2013 at 10:55
  • yeah - route-leaking is what I was looking for without knowing it....makes sense now. I'll try and build this this weekend and see how it goes!
    – knotseh
    May 30, 2013 at 13:12
  • @hestonk hope it helps :)
    – Bulki
    May 31, 2013 at 8:56
  • The wanconnection:N static routes do not make sense to me. It would be better example, if you'd have 2 LAN sides, 1 WAN side, default route (like you have already) to WAN side shared VRF but then you should have LAN side routes pointing to LAN next-hop.
    – ytti
    May 31, 2013 at 15:12
4

If you use VRF's then it is possible to make a hub & spoke VRF using just one router without the need for MPLS.

You need to use BGP but this doesnt need to peer with anyone, it is used simply to route between the VRF's.

What you would do it something like...

ip vrf GUEST
 rd 100:1
 route-target export 100:100
 route-target import 100:200

ip vrf CORP
 rd 100:2
 route-target export 100:100
 route-target import 100:200

ip vrf WAN
 rd 100:100
 route-target import 100:100
 route-target export 100:200

This would then export routes (like the default route) from the WAN VRF into the two VRF's but not export the other subnets to each other.

Improve this answer
2
  • Does this config also import the routes from the two VRFs into the WAN VRF?
    – generalnetworkerror
    May 30, 2013 at 8:22
  • Yes, this is done by the import of 100:100 on the WAN and the export of 100:100 on the other 2 VRF's
    – David Rothera
    May 30, 2013 at 12:28
3

It can be done using PBR. Push the traffic for the default gw from vrf into the global routing table. Please check the following link:

http://www.cisco.com/en/US/docs/ios/12_2sr/12_2srb/feature/guide/srb2mvrf.html#wp1060956

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.