Each fills a different purpose and all three may be part of an overall solution. Lets start with the oldest concept first.
Subnets are the IP worlds way of determining what devices are "assumed to be on-link". Devices within the same subnet will send unicast traffic directly to each other by default while devices in different subnets will send ...
This configuration works on our other switches, but it doesn't work on this 4500.
You're using the on-board Sup7 FastEthernet port, so this is your problem:
aaa authentication login default group tacacs+ local
The Sup7 OOB port is in a VRF; therefore, you have to configure Tacacs+ in a VRF
If no DHCP clients are connected directly to your distribution or core then you wouldn't need to configure DHCP snooping there. You would just configure your access layer switches to untrust every port except for your uplinks to the distribution switches.
With a bit of VRF-lite and VRF-aware-NAT and the help of the Cat-3850's routing capability, here's some config snippets that should work, or at least get you halfway there - all based on the diagram you showed.
A few caveats:
This example assumes that the Cat-3850 may act as L3 switch and that it can route at least between directly attached subnets/vlans.
is this on the right track?
Yes... very similar to the link in the comment... As you mentioned, you only need to do two things...
Configure NAT overload on the global interface
Put a static route in the VRF for the speed test server...
Assume your speed test server is at 172.16.10.5... and you're trying to ping it from a CE switch in ...
You have two questions here.
Can two networks with the same subnet be connected to the same router
in different VRF?
Yes, as long as the two domains (VRF A and VRF B) do not communicate with each other. Think of a VRF as a virtual router.
What would happens if I set up BGP to exchange route between the two
Things will not work, because ...
Documenting to help future googlers, since I could find no information about Mgmt-vrf online... I managed to find the solution while I was typing the question above. I remembered that the Sup7Es had IOS-XE 3.2.2 loaded when I pulled them out of the boxes; the other important fact was that 3.2.2 would not turn up the OOB interface on FastEthernet1 while I ...
VPNv4 is the "transport". Your VRF route-targets match on both devices. Long story short, RT is extcommunity that is sent over VPNv4 session in BGP update. If one of local import RTs matches received extcommunity, routes are being imported in VRF with this RT configured. Actually VPNv4 is quite complex and complete explanation is beyond the scope of this ...
IP subnets and VLANs are not mutually exclusive -- you don't choose one or the other. It most cases, there is a one-to-one correspondence between VLANs and subnets.
In your first example, assuming you're using IP, you are still going to have to assign IP subnets to the VLANs. So you would assign a separate IP subnet to VLAN 1 and 2. It is up to you ...
This would be a good fit for a VDC but looking it up I dont see the ASR supports VDCs, unless Im missing something.
VRFs are going to give you route table separation and should do the job quite well as long as you insure routes do not bleed between VRFs.
Since this is a virtual ASR could you not stand up a second and have it dedicated to the second AS?
1) How many virtual router [routing instances] can be created on the QFX5100?
The QFX5100 platform currently supports up to 512 virtual router routing instances.
2) How many VRF [routing instances] can be created on the MX480?
There are a few variables you may want to consider, (both software and hardware) namely the number of routes, routing ...
There are few options for you to route the traffic between VRFs. Below are two of them:
The first option is to use MP-BGP (Multiprotocol BGP) with RD (Route
Distinguisher) and RTs (Route Targets).
The second option is to use static routes and make use the global (default) routing table. I wrote a blog post about this option on my blog Netlabbuilder.
VRF (virtual routing and forwarding) is a core technology of MPLS which allows a service provider to provide BGP routing to many customer VPNs while isolating each customer's routing tables.
VRF lite provides the same isolation in an enterprise LAN.
Imagine you have a corporate LAN with a number of VLANs and a default gateway to the corporate WAN.
If you ...
Would I have to first leak my VRF routes into the GRT to do this?
Yes, you need to leak the routes.
But this is not enough. You also have to leak (at least some of) your GRT routes into the VRF for the return traffic. Also, you need to provide a data path for the actual traffic.
traceroute works by using probe packets with increasing TTL values. The hop where a packet's TTL times out is supposed to return an time exceeded ICMP message which is processed and displayed by traceroute. If a hop doesn't decrement the TTL you simply don't see it.
Apparently, PE2_2 doesn't decrement TTL in that path - without the (sanitized) configuration ...
That is how MPLS works. The packet doesn't get routed at that point, it is label switched.
Traceroute works by having the packet TTL expire and an ICMP message is sent back saying that the packet expired. Routers will decrement the TTL as they route the packet. MPLS doesn't route packets, it places labels on the packet and switches based on the labels. That ...
The solution seems to be to use rib-group. I always assumed rib-group and instance-import were interchangeable though, as the name suggests, rib-group works in the RIB whereas instance-import only works on the FIB.
Syntax is significantly more complex but it's nice in such that you can apply rib-group to individual BGP peers which avoids the need to ...
Just got it to work. The trick is to have something that generates traffic and triggers the cellular interface to connect. Didnt relize that the IP SLA i had configured on the global vrf made the connection work for me. So basically this fixed it for me:
ip sla 1000
ip sla schedule ...
Be very careful with that idea, unless you know EXACTLY what you are doing.
A) Adresses are in VRFs
It will cause no harm if these sets of loopback interfaces are on PE routers (or multi-vrf CEs) AND are part of different VRFs each (since were' talking about MPLS-VPN, here). In other words: IF each customer (VRF) gets their own set of ...
The routers within the backbone use a label distribution protocol: LDP or RSVP.
Each router binds a label to each IP prefix it knows about and advertises these labels to its LDP/RSVP peers.
Let's say router egress PE advertised its BGP loopback address to P3 with a label of 20. P3 then advertises it to P2 with a label of 21, P2 advertises this network to P1 ...
There are several different ways to accomplish this. Here's one way, assuming you're already running MP-BGP:
In the ISP VRF, have separate route tags for import and export, say 100 and 200 respectively. The VRF exports the default route with RT 200.
Each customer VRF imports 200, and exports its address block with RT 100.
In this way, the ISP VRF sees ...
Complexity is reason enough to use a simpler option if one is available. In this case, I'd recommend connecting each firewall to only one router and one Internet connection. GLBP would then be used for load balancing/fail-over. Tie GLBP to an IP SLA monitor for the Internet connection the router provides access to and you're finished.
IPv4 and IPv6 operate as 'ships in the night' as far as routing is concerned, so I see not benefit to separate VRFs with ipv4 in one and ipv6 in another. Also any dual stack hosts would need separate interfaces or separate tagged VLANs to operate dual stack. Now if you are concerned about RAM in the router VRF will not help that, for that concern route ...
Depending on the hardware you're talking about you should take different considerations.
For instance Cisco provides a dedicated set of port/RAM and flash for OOB access on SUP2T, so you would be able to access to your device even when RP hangs. OTOH, in some Juniper boxes, the management port is attached directly to the RE and so you should easily hang ...
Since you have enabled OSPF on the connected interface, it will be an internal route for the networks behind the CE1.
But all OSPF routes on the CE1 side will be external routes on the CE2 side, because they all are redistributed to/from mBGP. To make them internal, you need a sham link.
Administrative distance doesn't really come into play here. AD ...
Have you checked the debug outputs for l2x, ppp, radius?
One thing I see is that you should set ip unnumbered on your Virtual-Template. ip address negotiated means your end will try to get an address from the client, when you should be offering one to them (via the Framed-IP-Address and Framed-IP-Netmask attributes in the RADIUS Access-Accept)
First create ...
it is depend
you must verify the current CPU usage before any routing edit , if it is in suitable rang (not exceed 10%-15% ) then you can start to create VRF routes
if you create all your routes in one router you will get one benefit and one drawback. benefit is that you can point to this router by only one route from your core layer , drawback is that you ...