10 votes
Accepted

VRFs, VLANs and subnets: difference

Each fills a different purpose, and all three may be part of an overall solution. Let's start with the oldest concept first. Subnets are the IP world's way of determining what devices are "...
Peter Green's user avatar
  • 13.3k
8 votes
Accepted

NAT VLANs with same IP Subnets

With a bit of VRF-lite and VRF-aware-NAT and the help of the Cat-3850's routing capability, here's some config snippets that should work, or at least get you halfway there - all based on the diagram ...
Marc 'netztier' Luethi's user avatar
6 votes
Accepted

Can two networks with the same subnet be connected to the same router in different VRF?

You have two questions here. Can two networks with the same subnet be connected to the same router in different VRF? Yes, as long as the two domains (VRF A and VRF B) do not communicate with ...
Ron Trunk's user avatar
  • 67.5k
5 votes
Accepted

Understanding MP-BGP basics

VPNv4 is the "transport". Your VRF route-targets match on both devices. Long story short, RT is extcommunity that is sent over VPNv4 session in BGP update. If one of local import RTs matches received ...
ar_'s user avatar
  • 1,133
5 votes
Accepted

Identify vrf within packet capture

When capturing raw data from a link, is it even possible to find a vrf value, or a route-target ? A VRF is meaningful only to a router, so once the data leaves the router the question becomes ...
Ron Trunk's user avatar
  • 67.5k
4 votes
Accepted

What is the difference between a VRF and VRF-Lite?

VRF (virtual routing and forwarding) is a core technology of MPLS which allows a service provider to provide BGP routing to many customer VPNs while isolating each customer's routing tables. VRF lite ...
grahamj42's user avatar
  • 360
4 votes
Accepted

Cisco routing between two VRF

There are few options for you to route the traffic between VRFs. Below are two of them: The first option is to use MP-BGP (Multiprotocol BGP) with RD (Route Distinguisher) and RTs (Route Targets). ...
Hung Tran's user avatar
  • 3,754
4 votes

VRFs, VLANs and subnets: difference

IP subnets and VLANs are not mutually exclusive -- you don't choose one or the other. It most cases, there is a one-to-one correspondence between VLANs and subnets. In your first example, assuming ...
Ron Trunk's user avatar
  • 67.5k
4 votes

Traceroute doesn't show one hop?

That is how MPLS works. The packet doesn't get routed at that point, it is label switched. Traceroute works by having the packet TTL expire and an ICMP message is sent back saying that the packet ...
Ron Maupin's user avatar
  • 99.6k
4 votes

Traceroute doesn't show one hop?

traceroute works by using probe packets with increasing TTL values. The hop where a packet's TTL times out is supposed to return an time exceeded ICMP message which is processed and displayed by ...
Zac67's user avatar
  • 84.4k
4 votes

BGP - Advertise VRF routes

Would I have to first leak my VRF routes into the GRT to do this? Yes, you need to leak the routes. But this is not enough. You also have to leak (at least some of) your GRT routes into the VRF ...
Ron Trunk's user avatar
  • 67.5k
4 votes
Accepted

Juniper MX: Leaking routes from RIB into VRF

The solution seems to be to use rib-group. I always assumed rib-group and instance-import were interchangeable though, as the name suggests, rib-group works in the RIB whereas instance-import only ...
phil-lavin's user avatar
4 votes
Accepted

Cellular interface in VRF (LTE)

Just got it to work. The trick is to have something that generates traffic and triggers the cellular interface to connect. Didnt relize that the IP SLA i had configured on the global vrf made the ...
Mario Jost's user avatar
  • 1,709
4 votes

How to isolate in VRF clients with public IPs in MPLS ISP network

There are several different ways to accomplish this. Here's one way, assuming you're already running MP-BGP: In the ISP VRF, have separate route tags for import and export, say 100 and 200 ...
Ron Trunk's user avatar
  • 67.5k
3 votes
Accepted

Should the Loopback address be unique across the network?

TL;DR Be very careful with that idea, unless you know EXACTLY what you are doing. Longer: A) Adresses are in VRFs It will cause no harm if these sets of loopback interfaces are on PE routers (or ...
Marc 'netztier' Luethi's user avatar
3 votes
Accepted

Can I use the same IPsec tunnel for two VRF?

Cisco routers have a feature called VRF aware IPSec. It is available in version 12.2(33) and later. Here’s a brief introduction. Other companies may have similar features.
Ron Trunk's user avatar
  • 67.5k
3 votes
Accepted

BGP and Inter-VRF Routing

Use the command neighbor x.x.x.x allowas in This tells the router not to discard prefixes with its own ASN in the path.
Ron Trunk's user avatar
  • 67.5k
3 votes
Accepted

Cisco IOS Software [Everest], ISR 4331. Vlan+Vrf+Dhcp

EDITED: Here are a few things to check: Can your PC really send tagged frames (most PCs can't)? Your VRF is named VRF200, but your config shows VLAN200 Be sure you enter vrf forwarding VRF200 before ...
Ron Trunk's user avatar
  • 67.5k
3 votes
Accepted

MPLS-BGP - VPN isolation - RFC 4364

The routers within the backbone use a label distribution protocol: LDP or RSVP. Each router binds a label to each IP prefix it knows about and advertises these labels to its LDP/RSVP peers. Let's say ...
manish ma's user avatar
  • 1,614
2 votes

Limit Access to a Specific VRF?

Since there's no "vrf mode," I can't see any way to make this happen. You could use ACS to prevent them from entering config mode -- that would give them access to show commands. Presumably that's ...
Ron Trunk's user avatar
  • 67.5k
2 votes

VRFs, VLANs and subnets: difference

VLAN's are said to isolate broadcast and failure domains. A single subnet is typically configured per VLAN and sets the IP (layer3) addressing. VRF separates route tables on the same device.
Ronnie Royston's user avatar
2 votes

Multiple IPSEC tunnels between 2 Cisco Routers

You could build this quite simply using VTIs (GRE tunnels with IPSec protection). As the two tunnels have the same source, destination IP pairs, you will need to make sure you use a unique (per tunnel)...
Patrick Mackey's user avatar
2 votes

Cisco VRF with two ISP

If your goal is isolation of traffic then you'd have downstream ports on the switch that would be in VRF's A or B and then configure routing within the respective vrf's (either BGP or just a static ...
rnxrx's user avatar
  • 6,114
2 votes
Accepted

Cisco VRF aware dynamic VTI based IPSEC VPN

Cisco bug on ASR1k that causes issues in IPSEC over GRE configuration with AH and ESP Mixed configuration CSCtb60545 / CSCsv96390 changed ah-sha-hmac to esp-sha-hmac in the Transform-set ...
Andreas Schaefer's user avatar
2 votes
Accepted

Can I use a Dynamic Routing Protocol in this scenario?

I'm not familiar enough with Dell routers to know if you can have address families in OSPF. But even if you can, OSPF is a poor choice, because it's difficult to filter advertisements--each VRF will ...
Ron Trunk's user avatar
  • 67.5k
2 votes

Traceroute doesn't show one hop?

Weirdly enough, this was caused by a command on PE2_2 juniper. delete routing-instances L3VPN-1 vrf-table-label solved this behaviour, now i get: CE1#trace 192.168.0.1 Type escape sequence to abort. ...
Radovan's user avatar
  • 141
2 votes

What is the difference between a VRF and VRF-Lite?

VRF-Lite is to use VRF without MPLS.:) With VRF across service-provider network, MPLS is used to carry route information across each router for every VRF. Each VRF has its own routing policy. With VRF-...
Amjad Abdullah's user avatar
2 votes
Accepted

What is the use of route-target without export/import?

You are misreading the help prompt. The full command is route-target aa:bb [import|export|both] If you enter just route-target aa:bb it will be rejected as an incomplete command.
Ron Trunk's user avatar
  • 67.5k
2 votes
Accepted

what do i need to configure to route vrf to internet in a very simple way?

You need to put gi 0/3 in vrf A Int gi 0/3 Vrf forwarding A ip address 192.0.0.2 255.255.255.0
Ron Trunk's user avatar
  • 67.5k

Only top scored, non community-wiki answers of a minimum length are eligible