Summary of the content on the page No. 1
Technical Guide
How To |
Configure VRF-lite
Introduction
In IP-based networks, VRF stands for Virtual Routing and Forwarding. This technology allows
multiple routing domains to co-exist within the same device at the same time. As the routing
domains are independent, overlapping IP addresses can be used without causing conflict. In
large service provider networks, virtual routing and forwarding is used in conjunction with
MPLS - Multi Protocol Label Switching - to separate each customer’s t
Summary of the content on the page No. 2
Introduction Who should read this document? This document is aimed at advanced network engineers. Which products and software version does it apply to? The information provided in this document applies to: SwitchBlade AT-x908 and AT-x900 series switches running 5.4.1 and above. x610 switches running AlliedWare+ version 5.4.2 and above. Note: VRF -lite is not supported in the x600 series switch. Software feature licenses The VRF-lite feature requires a special software license. Without a p
Summary of the content on the page No. 3
Introduction Contents Introduction.............................................................................................................................................................................1 What is VRF-lite? .........................................................................................................................................................1 Who should read this document?........................................................................................
Summary of the content on the page No. 4
Glossary Glossary ACRONYM DESCRIPTION AS Autonomous System ACL Access Control List BGP Border Gateway Protocol FIB Forwarding Information Base MPLS Multi-Protocol Label Switching OSPF Open Shortest Path First RIP Routing Information Protocol VPN Virtual Private Network VR Virtual Router VRF Virtual Routing and Forwarding VRF-lite VRF without MPLS network CE Customer edge PE Provider edge RD Route Distinguisher RT Route Target VCStack Virtual Chassis Stacking Page 4 | Configure VRF-lite
Summary of the content on the page No. 5
Understanding VRF-lite Understanding VRF-lite The purpose of VRF is to enable separate IP networks, possibly using overlapping IP addresses, to share the same links and routers. IP traffic is constrained to a set of separate IP Virtual Private Networks (VPNs). These VPNs provide a secure way for a service provider to carry multiple customers’ IP networks across a common infrastructure. The different customers’ IP networks are able to operate in complete isolation from each other, so there is
Summary of the content on the page No. 6
SW vlan1 1.1.1.1/24 vlan5 1.1.1.1/24 vlan2 10.1.1.1/8 vlan6 10.1.1.1/24 Understanding VRF-lite VRF-lite security domains VRF-lite provides network isolation on a single device at Layer 3. Each VRF domain can use the same or overlapping network addresses, as they have independent routing tables. This separation of the routing tables prevents communication to Layer 3 interfaces in other VRF domains on the same device. Each Layer 3 interface belongs to exactly one VRF instance and traffic betwe
Summary of the content on the page No. 7
Understanding VRF-lite When a Layer 3 interface is moved to a VRF instance from the default global VRF domain, or when a Layer 3 interface is moved from one VRF instance to another via command, the interface name and id (ifindex) are never changed as a result of the interface movement. However IP configuration on the interface in the previous VRF is unset (removed) before moving the interface to a new VRF. ARP entries associated with the Layer 3 interface are cleared when the interface is mo
Summary of the content on the page No. 8
VRF shared VRF green VRF red (company) (Wi-Fi) Understanding VRF-lite Inter-VRF communication Whilst the prime purpose of VRF-lite is to keep routing domains separate from each other, there are cases where you do want some communication between VRFs. An example to consider is multiple 'clients' requiring shared Internet access. In this case a VRF instance can be created for each, providing secure and separate routing. Whilst overlapping IP addresses could be used with this scenario, only o
Summary of the content on the page No. 9
Understanding VRF-lite Static and dynamic inter-VRF routing As mentioned above, "Inter-VRF communication" on page 8, in some circumstances it is required to (selectively) allow traffic between two interfaces that are not in the same VRF. This will be useful if there is common network equipment (e.g. Internet connections or shared resources) that multiple VRFs need to share. Inter-VRF routing is achieved by statically or dynamically taking a route entry and its next-hop interface from one VRF
Summary of the content on the page No. 10
Understanding VRF-lite VRF-lite features in AW+ Here is a summary of the features provided by the AW+ VRF-lite implementation: Multiple independent routing table instances may co-exist within the same device. The same or overlapping IP addresses can be present in different route table instances without conflicting. All routing table instances remain securely isolated from those existing in other routing tables. By default, no communication occurs between VRF instances, facilitating multi
Summary of the content on the page No. 11
Understanding VRF-lite Route limiting per VRF instance In a multi-VRF network environment, it may be problematic if one VRF injects too many routes and fills up the hardware forwarding table (FIB) on the device, which can affect other VRFs as well as the global VRF. For more information see "Route Limits" on page 84 VRF-aware utilities within AW+ Some network utility and management features such as ping, traceroute, telnet client, SSH client, and tcpdump are supported in a VRF aware manner.
Summary of the content on the page No. 12
Understanding VRF-lite Telnet client awplus#telnet ? WORD IPv4/IPv6 address or hostname of a remote system ip IP telnet ipv6 IPv6 telnet vrf VRF instance awplus#telnet vrf ? WORD IPv4 address or hostname of a remote system ip IP telnet awplus#telnet vrf ip x.x.x.x SSH client awplus#ssh ? HOSTNAME IP/IPv6 address or hostname of a remote server client Configure global SSH client parameters ip IP SSH ipv6 IPv6 SSH port SSH s
Summary of the content on the page No. 13
Configuring VRF-lite Configuring VRF-lite The following section describes the generic commands used to configure VRF-lite. CONFIGURING ACLS PURPOSE Step 1 awplus# conf t Enter Global Configuration mode. Step 2 awplus(config)# access-list standard Optional. This command configures a standard {deny| named access-control-list (ACL). Matching permit} networks (routes) are either imported to or exported from a VRF instance to BGP. Alternatively, matching networks are
Summary of the content on the page No. 14
Configuring VRF-lite CONFIGURING VLANS AND VLAN DATABASE PURPOSE Step 1 awplus(config)#vlan database VLANs are created in the VLAN database, and ports are assigned to relevant VLANs. Step 2 awplus(config-vlan)#vlan x state enable Step 3 awplus(config-vlan)#exit Step 4 awplus(config)#interface portx.x.x Step 5 awplus(config-if)#switchport access vlanx Step 6 awplus(config-if)#exit CONFIGURING LOCAL LOOPBACK IP INTERFACE PURPOSE Step 1 awplus(config-if)#interface lo1 Step 2 awplus(config-if)#ip a
Summary of the content on the page No. 15
Configuring VRF-lite DYNAMIC ROUTING PROTOCOL - RIP ADDRESS-FAMILY PURPOSE Step 1 awplus(config)#router rip Optional. Enter router configuration mode for RIP. Step 2 awplus(config-router)#address-family Associate a RIP address-family with a specific ipv4 vrf VRF instance. Step 3 awplus(config-router-af)#network Define a network on which the RIP address- x.x.x.x/x family runs. Step 4 awplus(config-router-af)#redistribute Configure the device to redistribute information fr
Summary of the content on the page No. 16
Configuring VRF-lite STATIC ROUTES PURPOSE Step 1 awplus(config)# ip route vrf Optional. To add a static route into the Routing { | table for a VRF instance. This can be a route } pointing externally to a nexthop reachable via an interface in this VRF instance, or it can be used to facilitate inter-VRF routing, in which case it would point to an interface in a different VRF instance. Static inter-VRF routes can be used instead of BGP, or in
Summary of the content on the page No. 17
Configuring VRF-lite Static inter-VRF routing Static inter-VRF routing involves creating static routes in one VRF instance whose egress VLAN is in a different egress VLAN. These static routes must specify both the egress VLAN and next hop IP address. The following diagram illustrates use of static routing to achieve inter- VRF communication in VRF-lite. 192.168.20.0/24 192.168.20.0/24 global default VRF domain VRF green 192.168.1.0/24 192.168.50.0/24 VRF red VRF blue 192.168.20.6 192.168.50.
Summary of the content on the page No. 18
BGP RIP BGP RIP address- address- address- OSPF 1 address- OSPF 2 family family family family red red blue blue VRF VRF red blue FIB FIB Dynamic inter-VRF communication explained Dynamic inter-VRF communication explained The following section explains how VRF routing domain isolation is maintained, and how routes that exist in one VRF instance are leaked to another VRF instance via BGP. Only BGP can be used to dynamically leak routes from one VRF instance to another. The Forwarding Informa
Summary of the content on the page No. 19
Dynamic inter-VRF communication explained The command redistribute can be configured in an OSPF instance, BGP address-family, or RIP address-family. Via this command, routes are imported from the FIB associated with the VRF instance into the dynamic routing protocol table. Any routing protocol (OSPF, BGP, RIP static, connected, etc.) can be redistributed. For example, if OSPF instance1 is configured on VRF red, and if OSPF 1 contains the command redistribute BGP, then BGP routes
Summary of the content on the page No. 20
OSFP peer OSFP peer router router OSPF 1 OSPF 2 VRF VRF blue red FIB FIB BGP BGP address- address- family family red blue Dynamic inter-VRF communication explained Inter-VRF communication via BGP Dynamic inter-VRF route leakage is achieved by making copies of BGP routes that exist in one BGP address-family associated with one VRF instance, to another BGP address-family associated with a different VRF instance. Redistribute BGP from VRF red FIB Redistribute OSPF Redistribute BGP from VRF red
