Hot answers tagged

9

Each fills a different purpose and all three may be part of an overall solution. Lets start with the oldest concept first. Subnets are the IP worlds way of determining what devices are "assumed to be on-link". Devices within the same subnet will send unicast traffic directly to each other by default while devices in different subnets will send ...


7

With a bit of VRF-lite and VRF-aware-NAT and the help of the Cat-3850's routing capability, here's some config snippets that should work, or at least get you halfway there - all based on the diagram you showed. A few caveats: This example assumes that the Cat-3850 may act as L3 switch and that it can route at least between directly attached subnets/vlans. ...


6

Summary is this on the right track? Yes... very similar to the link in the comment... As you mentioned, you only need to do two things... Configure NAT overload on the global interface Put a static route in the VRF for the speed test server... Details Assume your speed test server is at 172.16.10.5... and you're trying to ping it from a CE switch in ...


6

You have two questions here. Can two networks with the same subnet be connected to the same router in different VRF? Yes, as long as the two domains (VRF A and VRF B) do not communicate with each other. Think of a VRF as a virtual router. What would happens if I set up BGP to exchange route between the two VRF? Things will not work, because ...


5

Documenting to help future googlers, since I could find no information about Mgmt-vrf online... I managed to find the solution while I was typing the question above. I remembered that the Sup7Es had IOS-XE 3.2.2 loaded when I pulled them out of the boxes; the other important fact was that 3.2.2 would not turn up the OOB interface on FastEthernet1 while I ...


5

VPNv4 is the "transport". Your VRF route-targets match on both devices. Long story short, RT is extcommunity that is sent over VPNv4 session in BGP update. If one of local import RTs matches received extcommunity, routes are being imported in VRF with this RT configured. Actually VPNv4 is quite complex and complete explanation is beyond the scope of this ...


4

There are few options for you to route the traffic between VRFs. Below are two of them: The first option is to use MP-BGP (Multiprotocol BGP) with RD (Route Distinguisher) and RTs (Route Targets). The second option is to use static routes and make use the global (default) routing table. I wrote a blog post about this option on my blog Netlabbuilder. There ...


4

IP subnets and VLANs are not mutually exclusive -- you don't choose one or the other. It most cases, there is a one-to-one correspondence between VLANs and subnets. In your first example, assuming you're using IP, you are still going to have to assign IP subnets to the VLANs. So you would assign a separate IP subnet to VLAN 1 and 2. It is up to you ...


4

1) How many virtual router [routing instances] can be created on the QFX5100? The QFX5100 platform currently supports up to 512 virtual router routing instances. 2) How many VRF [routing instances] can be created on the MX480? There are a few variables you may want to consider, (both software and hardware) namely the number of routes, routing ...


4

This would be a good fit for a VDC but looking it up I dont see the ASR supports VDCs, unless Im missing something. VRFs are going to give you route table separation and should do the job quite well as long as you insure routes do not bleed between VRFs. Since this is a virtual ASR could you not stand up a second and have it dedicated to the second AS? ...


4

VRF (virtual routing and forwarding) is a core technology of MPLS which allows a service provider to provide BGP routing to many customer VPNs while isolating each customer's routing tables. VRF lite provides the same isolation in an enterprise LAN. Imagine you have a corporate LAN with a number of VLANs and a default gateway to the corporate WAN. If you ...


4

Would I have to first leak my VRF routes into the GRT to do this? Yes, you need to leak the routes. But this is not enough. You also have to leak (at least some of) your GRT routes into the VRF for the return traffic. Also, you need to provide a data path for the actual traffic.


4

traceroute works by using probe packets with increasing TTL values. The hop where a packet's TTL times out is supposed to return an time exceeded ICMP message which is processed and displayed by traceroute. If a hop doesn't decrement the TTL you simply don't see it. Apparently, PE2_2 doesn't decrement TTL in that path - without the (sanitized) configuration ...


4

That is how MPLS works. The packet doesn't get routed at that point, it is label switched. Traceroute works by having the packet TTL expire and an ICMP message is sent back saying that the packet expired. Routers will decrement the TTL as they route the packet. MPLS doesn't route packets, it places labels on the packet and switches based on the labels. That ...


4

The solution seems to be to use rib-group. I always assumed rib-group and instance-import were interchangeable though, as the name suggests, rib-group works in the RIB whereas instance-import only works on the FIB. Syntax is significantly more complex but it's nice in such that you can apply rib-group to individual BGP peers which avoids the need to ...


4

Just got it to work. The trick is to have something that generates traffic and triggers the cellular interface to connect. Didnt relize that the IP SLA i had configured on the global vrf made the connection work for me. So basically this fixed it for me: ip sla 1000 icmp-echo 8.8.8.8 vrf DSL threshold 500 timeout 1000 frequency 4 ip sla schedule ...


4

When capturing raw data from a link, is it even possible to find a vrf value, or a route-target ? A VRF is meaningful only to a router, so once the data leaves the router the question becomes meaningless. Route targets are attributes of routing information, not data. MPLS packets don’t contain that information. You can capture the MPLS labels and determine ...


3

Cisco routers have a feature called VRF aware IPSec. It is available in version 12.2(33) and later. Here’s a brief introduction. Other companies may have similar features.


3

TL;DR Be very careful with that idea, unless you know EXACTLY what you are doing. Longer: A) Adresses are in VRFs It will cause no harm if these sets of loopback interfaces are on PE routers (or multi-vrf CEs) AND are part of different VRFs each (since were' talking about MPLS-VPN, here). In other words: IF each customer (VRF) gets their own set of ...


3

The routers within the backbone use a label distribution protocol: LDP or RSVP. Each router binds a label to each IP prefix it knows about and advertises these labels to its LDP/RSVP peers. Let's say router egress PE advertised its BGP loopback address to P3 with a label of 20. P3 then advertises it to P2 with a label of 21, P2 advertises this network to P1 ...


3

There are several different ways to accomplish this. Here's one way, assuming you're already running MP-BGP: In the ISP VRF, have separate route tags for import and export, say 100 and 200 respectively. The VRF exports the default route with RT 200. Each customer VRF imports 200, and exports its address block with RT 100. In this way, the ISP VRF sees ...


2

Since you have enabled OSPF on the connected interface, it will be an internal route for the networks behind the CE1. But all OSPF routes on the CE1 side will be external routes on the CE2 side, because they all are redistributed to/from mBGP. To make them internal, you need a sham link. Administrative distance doesn't really come into play here. AD ...


2

Have you checked the debug outputs for l2x, ppp, radius? One thing I see is that you should set ip unnumbered on your Virtual-Template. ip address negotiated means your end will try to get an address from the client, when you should be offering one to them (via the Framed-IP-Address and Framed-IP-Netmask attributes in the RADIUS Access-Accept) First create ...


2

Complexity is reason enough to use a simpler option if one is available. In this case, I'd recommend connecting each firewall to only one router and one Internet connection. GLBP would then be used for load balancing/fail-over. Tie GLBP to an IP SLA monitor for the Internet connection the router provides access to and you're finished.


2

IPv4 and IPv6 operate as 'ships in the night' as far as routing is concerned, so I see not benefit to separate VRFs with ipv4 in one and ipv6 in another. Also any dual stack hosts would need separate interfaces or separate tagged VLANs to operate dual stack. Now if you are concerned about RAM in the router VRF will not help that, for that concern route ...


2

it is depend you must verify the current CPU usage before any routing edit , if it is in suitable rang (not exceed 10%-15% ) then you can start to create VRF routes if you create all your routes in one router you will get one benefit and one drawback. benefit is that you can point to this router by only one route from your core layer , drawback is that you ...


2

Since there's no "vrf mode," I can't see any way to make this happen. You could use ACS to prevent them from entering config mode -- that would give them access to show commands. Presumably that's all they need.


2

I'm not familiar enough with Dell routers to know if you can have address families in OSPF. But even if you can, OSPF is a poor choice, because it's difficult to filter advertisements--each VRF will learn the routes of the other VRFs through the common VRF. BGP would make more sense since it allows you to control what routes you advertise. But there are ...


2

Use the command neighbor x.x.x.x allowas in This tells the router not to discard prefixes with its own ASN in the path.


Only top voted, non community-wiki answers of a minimum length are eligible