I'm trying to establish, from a security and networking perspective, if it is advisable to run a internet VRF on a PE router(Cisco 7609 PE) or to use a dedicated router instead(such as a mikrotek CCR1072-1G-8S+). Please assist if you can.

Thank you

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 12 '17 at 5:21

it is depend

  1. you must verify the current CPU usage before any routing edit , if it is in suitable rang (not exceed 10%-15% ) then you can start to create VRF routes
  2. if you create all your routes in one router you will get one benefit and one drawback. benefit is that you can point to this router by only one route from your core layer , drawback is that you will have single point of fail
| improve this answer | |
> from a security and networking perspective

I think is totally acceptable, most providers of mpls infrastructure, provide internet access to clients using VRF/MPLS to separate production and internet traffic.

Just verify that the management IP of the router is only accessible through the VRF you require it to be.

IOS devices will accept all VTY connections by default. However, if an access-class is used, the assumption is that connections should only arrive from the global IP instance.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.