I'm trying to establish, from a security and networking perspective, if it is advisable to run a internet VRF on a PE router(Cisco 7609 PE) or to use a dedicated router instead(such as a mikrotek CCR1072-1G-8S+). Please assist if you can.
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
it is depend
> from a security and networking perspective
I think is totally acceptable, most providers of mpls infrastructure, provide internet access to clients using VRF/MPLS to separate production and internet traffic.
Just verify that the management IP of the router is only accessible through the VRF you require it to be.
IOS devices will accept all VTY connections by default. However, if an access-class is used, the assumption is that connections should only arrive from the global IP instance.