Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Internet access with vrf lite
- Thread starter BicMac080
- Start date
You would deploy VRF-Lite usually on any CE which is required to support multiple VPN's. They are typically deployed in MPLS implementations where more than one VPN routing/forwarding (VRF) tables are required. This allows multiple customers to share the same CE and yet each VRF table is kept isolated from the other one (unless you redistribute) and allows these customers to exist in a secure/private environment and can even use overlapping address for example.
The following link refers to the 4500 but the configuration process is the same for any VRF-Lite capable device.
Just consider each VRF as a seperate routing table (which is exactly what they are) and add routing accordingly. You mention configuring Internet access. In the most basic sense, this could typically be adding a default route to point to, for example, a perimeter firewall.
On a non VRF-Lite CE, you would simply do something like:
ip route 0.0.0.0 0.0.0.0 a.b.c.d
where a.b.c.d is your firewall
On a VRF-Lite box, you can create default routes thus:
ip route 0.0.0.0 0.0.0.0 a.b.c.d
ip route vrf MYVRF 0.0.0.0 0.0.0.0 e.f.g.h
where MYVRF is the VRF instance of your 2nd VRF and e.f.g.h is an appropriate firewall address that exists in this VRF.
VRF-Lite supports more than 2 VRF's thus feasibly you could have multiple entries like the above.
Hope this helps
The following link refers to the 4500 but the configuration process is the same for any VRF-Lite capable device.
Just consider each VRF as a seperate routing table (which is exactly what they are) and add routing accordingly. You mention configuring Internet access. In the most basic sense, this could typically be adding a default route to point to, for example, a perimeter firewall.
On a non VRF-Lite CE, you would simply do something like:
ip route 0.0.0.0 0.0.0.0 a.b.c.d
where a.b.c.d is your firewall
On a VRF-Lite box, you can create default routes thus:
ip route 0.0.0.0 0.0.0.0 a.b.c.d
ip route vrf MYVRF 0.0.0.0 0.0.0.0 e.f.g.h
where MYVRF is the VRF instance of your 2nd VRF and e.f.g.h is an appropriate firewall address that exists in this VRF.
VRF-Lite supports more than 2 VRF's thus feasibly you could have multiple entries like the above.
Hope this helps
- Thread starter
- #3
- Status
