10
votes
Accepted
VRFs, VLANs and subnets: difference
Each fills a different purpose, and all three may be part of an overall solution. Let's start with the oldest concept first.
Subnets are the IP world's way of determining what devices are "...
- 13.8k
8
votes
Accepted
NAT VLANs with same IP Subnets
With a bit of VRF-lite and VRF-aware-NAT and the help of the Cat-3850's routing capability, here's some config snippets that should work, or at least get you halfway there - all based on the diagram ...
- 8,876
6
votes
Accepted
Can two networks with the same subnet be connected to the same router in different VRF?
You have two questions here.
Can two networks with the same subnet be connected to the same router
in different VRF?
Yes, as long as the two domains (VRF A and VRF B) do not communicate with ...
- 68.1k
5
votes
Accepted
Understanding MP-BGP basics
VPNv4 is the "transport". Your VRF route-targets match on both devices. Long story short, RT is extcommunity that is sent over VPNv4 session in BGP update. If one of local import RTs matches received ...
- 1,133
5
votes
Accepted
Identify vrf within packet capture
When capturing raw data from a link, is it even possible to find a vrf value, or a route-target ?
A VRF is meaningful only to a router, so once the data leaves the router the question becomes ...
- 68.1k
4
votes
Accepted
What is the difference between a VRF and VRF-Lite?
VRF (virtual routing and forwarding) is a core technology of MPLS which allows a service provider to provide BGP routing to many customer VPNs while isolating each customer's routing tables.
VRF lite ...
- 360
4
votes
Traceroute doesn't show one hop?
That is how MPLS works. The packet doesn't get routed at that point, it is label switched.
Traceroute works by having the packet TTL expire and an ICMP message is sent back saying that the packet ...
- 101k
4
votes
Traceroute doesn't show one hop?
traceroute works by using probe packets with increasing TTL values. The hop where a packet's TTL times out is supposed to return an time exceeded ICMP message which is processed and displayed by ...
- 88.1k
4
votes
BGP - Advertise VRF routes
Would I have to first leak my VRF routes into the GRT to do this?
Yes, you need to leak the routes.
But this is not enough. You also have to leak (at least some of) your GRT routes into the VRF ...
- 68.1k
4
votes
Accepted
Cisco routing between two VRF
There are few options for you to route the traffic between VRFs. Below are two of them:
The first option is to use MP-BGP (Multiprotocol BGP) with RD (Route
Distinguisher) and RTs (Route Targets).
...
- 3,754
4
votes
Accepted
Juniper MX: Leaking routes from RIB into VRF
The solution seems to be to use rib-group. I always assumed rib-group and instance-import were interchangeable though, as the name suggests, rib-group works in the RIB whereas instance-import only ...
- 211
4
votes
Accepted
Cellular interface in VRF (LTE)
Just got it to work. The trick is to have something that generates traffic and triggers the cellular interface to connect. Didnt relize that the IP SLA i had configured on the global vrf made the ...
- 1,729
4
votes
How to isolate in VRF clients with public IPs in MPLS ISP network
There are several different ways to accomplish this. Here's one way, assuming you're already running MP-BGP:
In the ISP VRF, have separate route tags for import and export, say 100 and 200 ...
- 68.1k
3
votes
Accepted
MPLS-BGP - VPN isolation - RFC 4364
The routers within the backbone use a label distribution protocol: LDP or RSVP.
Each router binds a label to each IP prefix it knows about and advertises these labels to its LDP/RSVP peers.
Let's say ...
- 1,700
3
votes
Accepted
Cisco IOS Software [Everest], ISR 4331. Vlan+Vrf+Dhcp
EDITED:
Here are a few things to check:
Can your PC really send tagged frames (most PCs can't)?
Your VRF is named VRF200, but your config shows
VLAN200
Be sure you enter
vrf forwarding VRF200
before ...
- 68.1k
3
votes
Accepted
Should the Loopback address be unique across the network?
TL;DR
Be very careful with that idea, unless you know EXACTLY what you are doing.
Longer:
A) Adresses are in VRFs
It will cause no harm if these sets of loopback interfaces are on PE routers (or ...
- 8,876
3
votes
Accepted
Can I use the same IPsec tunnel for two VRF?
Cisco routers have a feature called VRF aware IPSec. It is available in version 12.2(33) and later.
Here’s a brief introduction.
Other companies may have similar features.
- 68.1k
2
votes
Accepted
Can I use a Dynamic Routing Protocol in this scenario?
I'm not familiar enough with Dell routers to know if you can have address families in OSPF. But even if you can, OSPF is a poor choice, because it's difficult to filter advertisements--each VRF will ...
- 68.1k
2
votes
Multiple IPSEC tunnels between 2 Cisco Routers
You could build this quite simply using VTIs (GRE tunnels with IPSec protection). As the two tunnels have the same source, destination IP pairs, you will need to make sure you use a unique (per tunnel)...
2
votes
VRFs, VLANs and subnets: difference
VLAN's are said to isolate broadcast and failure domains.
A single subnet is typically configured per VLAN and sets the IP (layer3) addressing.
VRF separates route tables on the same device.
- 4,409
2
votes
Cisco VRF with two ISP
If your goal is isolation of traffic then you'd have downstream ports on the switch that would be in VRF's A or B and then configure routing within the respective vrf's (either BGP or just a static ...
- 6,152
2
votes
What is the difference between a VRF and VRF-Lite?
VRF-Lite is to use VRF without MPLS.:)
With VRF across service-provider network, MPLS is used to carry route information across each router for every VRF. Each VRF has its own routing policy.
With VRF-...
2
votes
Accepted
Cisco VRF aware dynamic VTI based IPSEC VPN
Cisco bug on ASR1k that causes issues in IPSEC over GRE configuration with AH and ESP Mixed configuration
CSCtb60545 / CSCsv96390
changed ah-sha-hmac to esp-sha-hmac in the Transform-set ...
- 534
2
votes
Accepted
What is the use of route-target without export/import?
You are misreading the help prompt. The full command is route-target aa:bb [import|export|both] If you enter just route-target aa:bb it will be rejected as an incomplete command.
- 68.1k
2
votes
Traceroute doesn't show one hop?
Weirdly enough, this was caused by a command on PE2_2 juniper.
delete routing-instances L3VPN-1 vrf-table-label solved this behaviour, now i get:
CE1#trace 192.168.0.1
Type escape sequence to abort.
...
- 141
2
votes
Accepted
what do i need to configure to route vrf to internet in a very simple way?
You need to put gi 0/3 in vrf A
Int gi 0/3
Vrf forwarding A
ip address 192.0.0.2 255.255.255.0
- 68.1k
2
votes
Accepted
Routing between VRFs through an outside bridge link
Dell engineering told me that, while it seems like it should work, this is not possible in the current firmware and this capability will not be added to the firmware.
- 181
2
votes
Why should we replicate route before doing inter-vrf redistribution
There are multiple ways to accomplish route leaking. Both redistribute vrf ... and route-replicate will accomplish this.
- 68.1k
2
votes
Accepted
Can I use VRF to loop around traffic through a firewall?
Generally, yes. Each VRF instance acts like a separate router. Using one VRF instance for public-to-firewall routing and another for firewall-to-internal should work.
However, you need to carefully ...
- 88.1k
Only top scored, non community-wiki answers of a minimum length are eligible