11

My knowledge of inter-VRF routing isn't the best.

I have one public IP. The public Internet and its quad 0 is on the default VRF....

Then I have a Guest_VRF and a corporate_VRF which would both need to access the Internet and point to the default gateway on the default VRF.

I can see this being done with multiple Cisco routers however I can't figure out a way that I could do this all-in-one device. I keep envisioning multiple NAT/PATs here which is just messy or using loopbacks and tunnels.

I'm focusing mainly on an ISR G1/G2 router here. Does anyone have any advice?

12

Using a VRF is like using a seperate router. If you have the same WAN IP for both VRF's, then you have to configure it twice in both WAN interfaces. If you however only use one WAN interface, you'll have to divide this interface by trunking (using VLAN's) or subinterfaces.

ex:

interface FastEthernet0.5
encapsulation dot1Q 5
ip address 1.1.1.1 255.255.255.252

Notice we do not use ip vrf forwarding, we are using the default vrf here

interface FastEthernet0.10
ip vrf forwarding wanconnection:1
encapsulation dot1Q 10
ip address 1.1.1.1 255.255.255.252 (<== this can be another IP if you prefer to divide it with 2 different IP's)

The connection then goes as follows:

  • your router (normal vrf) => wan connection => vpn used for dot1Q tag 5
  • your router (wanconnection:1 vrf) => wan connection => vpn used for dot1Q tag 10

if you want to do this without tagging and just have 2 physical interfaces, it's the same implementation:

interface FastEthernet0
ip address 1.1.1.1 255.255.255.252

interface FastEthernet1
ip vrf forwarding wanconnection:1
ip address 1.1.1.1 255.255.255.252 

Every other interface needed in the specific vrf "wanconnection:1" needs to be added in the same way:

ip vrf forwarding wanconnection:1

ex:

interface FastEthernet4
 ip vrf forwarding wanconnection:1
 ip address 10.0.0.1 255.255.255.0

making a vrf: http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/15.02SG/configuration/guide/vrf.html

ip vrf wanconnection:1
 rd 65000:1

the rd 100:1 command explained: Creates a VRF table by specifying a route distinguisher. Enter either an AS number and an arbitrary number (xxx:y) or an IP address and arbitrary number (A.B.C.D:y).

for the routing part:

ip route 0.0.0.0 0.0.0.0 1.1.1.2
ip route vrf wanconnection:1 0.0.0.0 0.0.0.0 1.1.1.2

If you only have one WAN connection without tagging enabled, you could use inter Vrf routing: http://packetlife.net/blog/2010/mar/29/inter-vrf-routing-vrf-lite/

ex:

ip vrf wanconnection:1
 rd 65000:1
 route-target export 65000:2
 route-target import 65000:99

ip vrf wanconnection:2
 rd 65000:2
 route-target export 65000:1
 route-target import 65000:99

ip vrf shared:1
 rd 65000:99
 route-target export 65000:99
 route-target import 65000:1
 route-target import 65000:2

interface FastEthernet0
ip vrf forwarding shared:1
ip address 1.1.1.1 255.255.255.252 

interface loopback1
ip vrf forwarding shared:1
ip address 2.2.2.2 255.255.255.255


ip route vrf shared:1 0.0.0.0 0.0.0.0 1.1.1.2
ip route vrf wanconnection:1 0.0.0.0 0.0.0.0 2.2.2.2
ip route vrf wanconnection:2 0.0.0.0 0.0.0.0 2.2.2.2

interface FastEthernet1
ip vrf forwarding wanconnection:1 
ip address 10.0.0.1 255.255.255.0
description "LAN interface vrf 1"

interface FastEthernet2
ip vrf forwarding wanconnection:2
ip address 10.0.2.1 255.255.255.0
description "LAN interface vrf 2"

here FastEthernet1 will use the default route for vrf wanconnection:1 and FastEthernet2 will use the default route for vrf wanconnection:2 (provided by the "ip route" commands).

  • I think the route leaking at the end is what he OP was after without knowing it :) – jwbensley May 30 '13 at 10:41
  • @javano I think so 2 :) but I hope I gave a bit of an overview of some of the possibilities :) – Bulki May 30 '13 at 10:55
  • yeah - route-leaking is what I was looking for without knowing it....makes sense now. I'll try and build this this weekend and see how it goes! – knotseh May 30 '13 at 13:12
  • @hestonk hope it helps :) – Bulki May 31 '13 at 8:56
  • The wanconnection:N static routes do not make sense to me. It would be better example, if you'd have 2 LAN sides, 1 WAN side, default route (like you have already) to WAN side shared VRF but then you should have LAN side routes pointing to LAN next-hop. – ytti May 31 '13 at 15:12
4

If you use VRF's then it is possible to make a hub & spoke VRF using just one router without the need for MPLS.

You need to use BGP but this doesnt need to peer with anyone, it is used simply to route between the VRF's.

What you would do it something like...

ip vrf GUEST
 rd 100:1
 route-target export 100:100
 route-target import 100:200

ip vrf CORP
 rd 100:2
 route-target export 100:100
 route-target import 100:200

ip vrf WAN
 rd 100:100
 route-target import 100:100
 route-target export 100:200

This would then export routes (like the default route) from the WAN VRF into the two VRF's but not export the other subnets to each other.

  • Does this config also import the routes from the two VRFs into the WAN VRF? – generalnetworkerror May 30 '13 at 8:22
  • Yes, this is done by the import of 100:100 on the WAN and the export of 100:100 on the other 2 VRF's – David Rothera May 30 '13 at 12:28
3

It can be done using PBR. Push the traffic for the default gw from vrf into the global routing table. Please check the following link:

http://www.cisco.com/en/US/docs/ios/12_2sr/12_2srb/feature/guide/srb2mvrf.html#wp1060956

protected by Community Apr 19 '15 at 16:46

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.