Eigrp Vrf-Lite Configuration

Eigrp Vrf-Lite Configuration

Posted By: March 31, 2021 Leave a Reply
vrf

The acronym VRF stands for Virtual routing and forwarding is an IP-based computer network technology that allows numerous virtual routers (VRs) to live in the same router as instances or virtual router instances (VRIs). A VRF can exist on one or more physical or logical interfaces, but none of the VRFs share routes. Only packets between interfaces on the same VRF are transmitted. 

Because the numerous routing instances are independent and can select different outgoing interfaces, overlapping IP addresses can be used without conflict.

What is VRF and how does it works?


VRFs operate on the OSI model's Layer 3 layer. Users can utilize independent routing instances to install IP internet protocol addresses that overlap or are the same without having to worry about conflicts. One of the main advantages of virtual routing and forwarding is that users can separate network paths without having to utilize numerous routers. 

This increases functionality by allowing network paths to be segmented without using multiple devices.

VRF can be divided into two categories: comprehensive VRF and VRF light. 

Here are the main distinctions.

Full VRF, like Layer 2 VLANS, focuses on labeling Layer 3 traffic via MPLS. In the service provider cloud context, the multiprotocol label switching or MPLS cloud uses the multiprotocol border gateway protocol or MP BGP. Through the MPLS cloud, VRF separates traffic from source to destination. 

Route Distinguishers (RDs) and Route Targets are used in VRF to separate overlapping routes and take advantage of shared services (RTs).

Whereas VRF light, which is a subset of VRF, is VRF without MPLS or MP BGP. VRF light is typically used to virtualize multiple security zones and network elements in an office LAN or data center environment. VRF full is a highly scalable system, however, VRF lite isn't.

Virtual Routing and Forwarding's Benefits 


  • Virtual routing and forwarding have a number of advantages:
  • Allows you to create many virtual routers on a single physical device.
  • Allows users to manage several routing tables at the same time.
  • MP BGP and MPLS deployments are both possible.
  • Customers can utilize overlapping IP addresses for several VPNs without conflict.
  • Users can segment network paths without having to use numerous routers, which improves network performance.


VPN vs VRF


A virtual private network (VPN) is a network that allows private services to be delivered over a public network. Virtual private networks (VPNs) are groups of websites that interact privately via other private or public networks on the internet. The term "private" in VPN does not imply encryption or security; it simply refers to a separate network path.

Multiple VPN environments can coexist in a router on the same physical network or infrastructure using virtual routing and forwarding (VRF) setups. This enables an organization to have segregated network services, such as wireless, phone (VoIP), data, and video, that sit in the same physical infrastructure but are not visible to each other. 

VRFs can also be utilized in MPLS deployments (multiprotocol label switching).

VRF vs. VRF Lite: A Comprehensive Comparison


Labeling (through MPLS) your traffic at layer 3 is what VRF is all about ( similar concept to Vlans at layer 2). The MPLS cloud, which uses MPBGP in the service provider Cloud environment, isolates traffic from source to destination in VRF. 

For overlapping Route segregation and utilizing Common services, RD and RTs (Route Distinguishers and Route Targets) are used. To run a full VRF, you'll need MBGP VPNv4 or MPLS. VRF with MPLS and MPBGP is VRF. In a Service Provider WAN context, where numerous clients must be routed across overlapping IP address space, full VRF is useful.

PE (Provider Edge) equipment is usually the sole option. Scope – Used to separate Customer Routing Tables on the WAN (MPLS) side in a Service Provider context. VRF information is shared among VRF-enabled devices.

VRF-Lite is a VRF that lacks MPLS and MPBGP (We can call VRF Lite a subset of VRF). VRF light is a method of virtualizing network elements and different security zones within a Data Center or an Office LAN environment. 

This can be useful if an organization's networks have overlapping IP addresses or if some segments must pass via a network firewall. The route target is not required for VRF-lite configuration; instead, static or dynamic routing can be used under the VRF instance.

VRF-lite is a simplified version of MPLS VPN. It only provides VRF-related capabilities (no MBGP VPNv4 or MPLS required). Scope — Used to separate Customer Security Zones in routing tables on the LAN side of the IT setup in a Customer Data Center scenario. 

VRFs are only relevant locally, and no information is transmitted across devices using VRF lite. VRF light is commonly used in the workplace and data centers. VRF-lite is a VRF that lacks MPLS and MPBGP.

VLANs vs. VDCs vs. VRFs


The virtualization of Layer 3 of the OSI model is enabled via virtual route forwarding instances (VRF). The goal of virtual device contexts (VDCs) is to virtualize the device itself. The VDC shows the physical switch as a collection of devices, each with its own set of VRFs and VLANs.

Switches that operate at Layer 2 of the OSI model are known as VLANs. VLANs divide Ethernet networks into many separated virtual networks in order to increase security and performance without limiting the network's physical configuration. 

VRFs, on the other hand, allow users to construct many VRs from a single physical piece of technology.

A static route is always associated with a VPN routing and forwarding (VRF) instance, whether it is the default VRF or one chosen by the user. Instead of providing a VRF, users can set a default VRF static route, which allows them to customize a static route in VRF configuration mode.

Configurations are step by step

VRF is used to create separate virtual routers on a single physical router and prevent traffic from one VRF interfering with another VRF.  We can isolate interfaces, forwarding tables, and routing tables respectively.

In this demonstration, I have used the GNS3 tool. 
Creating 3 VRF means 3 different logically isolated networks and assigned interfaces.

Router R1:-

R1#conf t
R1(config)#ip vrf RED
R1(config-vrf)#exit
R1(config)#ip vrf GREEN
R1(config-vrf)#exit
R1(config)#ip vrf BLUE

R1#conf t
R1(config)#interface f2/0
R1(config-if)#ip vrf forwarding RED
R1(config-if)#exit
R1(config)#interface f3/0
R1(config-if)#ip vrf forwarding GREEN
R1(config-if)#exit
R1(config)#interface f3/1
R1(config-if)#ip vrf forwarding BLUE

R1(config)#interface f2/0
R1(config-if)#no shut
R1(config-if)#exit
R1(config)#interface f3/0
R1(config-if)#no shut
R1(config-if)#exit
R1(config)#interface f3/1
R1(config-if)#no shut

R1#show ip vrf int
Interface              IP-Address      VRF                              Protocol
Fa3/1                  unassigned      BLUE                             up      
Fa3/0                  unassigned      GREEN                            up      
Fa2/0                  unassigned      RED                              up  

Assigned logical interfaces or subinterfaces in each vrf

R1(config)#interface f0/0.1
R1(config-subif)#ip vrf forwarding RED
R1(config-subif)#exit

R1(config)#interface f0/0.2
R1(config-subif)#ip vrf forwarding GREEN
R1(config-subif)#exit

R1(config)#interface f0/0.3
R1(config-subif)#ip vrf forwarding BLUE

R1(config)#interface f0/0
R1(config-if)#no shut

R1(config-if)#do show ip vrf int

Interface              IP-Address      VRF                              Protocol
Fa3/1                  unassigned      BLUE                             up      
Fa0/0.3                unassigned      BLUE                             up      
Fa3/0                  unassigned      GREEN                            up      
Fa0/0.2                unassigned      GREEN                            up      
Fa2/0                  unassigned      RED                              up      
Fa0/0.1                unassigned      RED                              up  
    
Assigning IP addresses for above created interfaces, VLAN 100,200,300 will be the same in each vrf.

R1(config)#interface f2/0
R1(config-if)#ip address 10.0.1.1 255.255.255.0
R1(config-if)#exit

R1(config)#interface f3/0
R1(config-if)#ip address 172.16.1.1 255.255.255.0
R1(config-if)#exit

R1(config)#interface f3/1
R1(config-if)#ip address 192.168.1.1 255.255.255.0

R1(config)#interface f0/0.1
R1(config-subif)#encapsulation dot1Q 100
R1(config-subif)#ip address 10.0.12.1 255.255.255.0
R1(config-subif)#exit

R1(config)#interface f0/0.2
R1(config-subif)#encapsulation dot1Q 200
R1(config-subif)#ip address 172.16.12.1 255.255.255.0
R1(config-subif)#exit

R1(config)#interface f0/0.3
R1(config-subif)#encapsulation dot1Q 300
R1(config-subif)#ip address 192.168.12.1 255.255.255.0

R1(config-subif)#do show ip vrf int
Interface              IP-Address      VRF                              Protocol
Fa3/1                  192.168.1.1     BLUE                             up      
Fa0/0.3                192.168.12.1    BLUE                             up      
Fa3/0                  172.16.1.1      GREEN                            up      
Fa0/0.2                172.16.12.1     GREEN                            up      
Fa2/0                  10.0.1.1        RED                              up      
Fa0/0.1                10.0.12.1       RED                              up      

R1(config-subif)#do show ip route vrf RED

Routing Table: RED

      10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
C        10.0.1.0/24 is directly connected, FastEthernet2/0
L        10.0.1.1/32 is directly connected, FastEthernet2/0
C        10.0.12.0/24 is directly connected, FastEthernet0/0.1
L        10.0.12.1/32 is directly connected, FastEthernet0/0.1

R1(config-subif)#do show ip route vrf GREEN

Routing Table: GREEN

      172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks
C        172.16.1.0/24 is directly connected, FastEthernet3/0
L        172.16.1.1/32 is directly connected, FastEthernet3/0
C        172.16.12.0/24 is directly connected, FastEthernet0/0.2
L        172.16.12.1/32 is directly connected, FastEthernet0/0.2

R1(config-subif)#do show ip route vrf BLUE 

Routing Table: BLUE

      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, FastEthernet3/1
L        192.168.1.1/32 is directly connected, FastEthernet3/1
      192.168.12.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.12.0/24 is directly connected, FastEthernet0/0.3
L        192.168.12.1/32 is directly connected, FastEthernet0/0.3

Testing Connectivity

R1#ping vrf RED 10.0.12.2  
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.12.2, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 64/120/152 ms

R1#ping vrf GREEN  172.16.12.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.12.2, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 76/109/144 ms

R1#ping vrf BLUE 192.168.12.2 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.12.2, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 92/101/128 ms

Provide Connectivity between each vrf. Eigrp is used. AS number 10, 172, 192 will be same in each vrf eigrp

R1#conf t
R1(config)#router eigrp VRFTEST
R1(config-router)#address-family ipv4 vrf RED autonomous-system 10
R1(config-router-af)#network 10.0.1.1 0.0.0.0
R1(config-router-af)#network 10.0.12.1 0.0.0.0
R1(config-router-af)#exit

R1(config-router)#address-family ipv4 vrf GREEN autonomous-system 172
R1(config-router-af)#network 172.16.1.1 0.0.0.0
R1(config-router-af)#network 172.16.12.1 0.0.0.0
R1(config-router-af)#exit

R1(config-router)#address-family ipv4 vrf BLUE autonomous-system 192
R1(config-router-af)#network 192.168.1.1 0.0.0.0
R1(config-router-af)#network 192.168.12.1 0.0.0.0

R1#show ip eigrp vrf RED neighbors
EIGRP-IPv4 VR(VRFTEST) Address-Family Neighbors for AS(10)
           VRF(RED)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   10.0.12.2               Fa0/0.1                  11 00:09:01   88   792  0  3
R1#show ip eigrp vrf GREEN neighbors
EIGRP-IPv4 VR(VRFTEST) Address-Family Neighbors for AS(172)
           VRF(GREEN)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   172.16.12.2             Fa0/0.2                  10 00:08:43  156  1404  0  3
R1#show ip eigrp vrf BLUE neighbors 
EIGRP-IPv4 VR(VRFTEST) Address-Family Neighbors for AS(192)
           VRF(BLUE)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   192.168.12.2            Fa0/0.3                  14 00:08:06  104   936  0  3
R1#
R1#show ip eigrp vrf BLUE neighbors
EIGRP-IPv4 VR(VRFTEST) Address-Family Neighbors for AS(192)
           VRF(BLUE)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   192.168.12.2            Fa0/0.3                  12 00:41:17   96   576  0  8

Test connectivity

R1#ping vrf RED 10.0.3.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.3.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 156/216/292 ms
R1#ping vrf GREEN 172.16.3.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.3.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 168/236/288 ms
R1#ping vrf BLUE 192.168.3.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.3.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 152/226/376 ms

R1#sh ip route vrf RED

      10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
C        10.0.1.0/24 is directly connected, FastEthernet2/0
L        10.0.1.1/32 is directly connected, FastEthernet2/0
D        10.0.3.0/24 [90/204800] via 10.0.12.2, 00:05:10, FastEthernet0/0.1
C        10.0.12.0/24 is directly connected, FastEthernet0/0.1
L        10.0.12.1/32 is directly connected, FastEthernet0/0.1
D        10.0.23.0/24 [90/153600] via 10.0.12.2, 00:15:15, FastEthernet0/0.1

Router R2:-

ip vrf BLUE
!
ip vrf GREEN
!         
ip vrf RED

interface FastEthernet0/0.1
 encapsulation dot1Q 100
 ip vrf forwarding RED
 ip address 10.0.12.2 255.255.255.0
!         
interface FastEthernet0/0.2
 encapsulation dot1Q 200
 ip vrf forwarding GREEN
 ip address 172.16.12.2 255.255.255.0
!         
interface FastEthernet0/0.3
 encapsulation dot1Q 300
 ip vrf forwarding BLUE
 ip address 192.168.12.2 255.255.255.0
!         
interface FastEthernet2/0
 no ip address
 duplex full
!         
interface FastEthernet2/0.1
 encapsulation dot1Q 100
 ip vrf forwarding RED
 ip address 10.0.23.2 255.255.255.0
!         
interface FastEthernet2/0.2
 encapsulation dot1Q 200
 ip vrf forwarding GREEN
 ip address 172.16.23.2 255.255.255.0

interface FastEthernet2/0.3
 encapsulation dot1Q 300
 ip vrf forwarding BLUE
 ip address 192.168.23.2 255.255.255.0

router eigrp VRFTEST
 !        
 address-family ipv4 unicast vrf RED autonomous-system 10
  !       
  topology base
  exit-af-topology
  network 10.0.12.2 0.0.0.0
  network 10.0.23.2 0.0.0.0
 exit-address-family
 !        
 address-family ipv4 unicast vrf GREEN autonomous-system 172
  !       
  topology base
  exit-af-topology
  network 172.16.12.2 0.0.0.0
  network 172.16.23.2 0.0.0.0
 exit-address-family
 !        
 address-family ipv4 unicast vrf BLUE autonomous-system 192
  !       
  topology base
  exit-af-topology
  network 192.168.12.2 0.0.0.0
  network 192.168.23.2 0.0.0.0
 exit-address-family

Router 3:- 

ip vrf BLUE
!
ip vrf GREEN
!         
ip vrf RED

interface FastEthernet0/0
 ip vrf forwarding RED
 ip address 10.0.3.3 255.255.255.0
 duplex full
!         
interface FastEthernet2/0
 no ip address
 duplex full
!         
interface FastEthernet2/0.1
 encapsulation dot1Q 100
 ip vrf forwarding RED
 ip address 10.0.23.3 255.255.255.0
!         
interface FastEthernet2/0.2
 encapsulation dot1Q 200
 ip vrf forwarding GREEN
 ip address 172.16.23.3 255.255.255.0
!         
interface FastEthernet2/0.3
 encapsulation dot1Q 300
 ip vrf forwarding BLUE
 ip address 192.168.23.3 255.255.255.0
!         
interface FastEthernet3/0
 ip vrf forwarding GREEN
 ip address 172.16.3.3 255.255.255.0
 speed auto
 duplex auto
!         
interface FastEthernet3/1
 ip vrf forwarding BLUE
 ip address 192.168.3.3 255.255.255.0
 speed auto
 duplex auto

router eigrp VRFTEST
 !        
 address-family ipv4 unicast vrf RED autonomous-system 10
  !       
  topology base
  exit-af-topology
  network 10.0.3.3 0.0.0.0
  network 10.0.23.3 0.0.0.0
 exit-address-family
 !        
 address-family ipv4 unicast vrf GREEN autonomous-system 172
  !       
  topology base
  exit-af-topology
  network 172.16.3.3 0.0.0.0
  network 172.16.23.3 0.0.0.0
 exit-address-family
 !        
 address-family ipv4 unicast vrf BLUE autonomous-system 192
  !       
  topology base
  exit-af-topology
  network 192.168.3.3 0.0.0.0
  network 192.168.23.3 0.0.0.0
 exit-address-family

Testing Connectivity: 

R1#ping vrf RED 10.0.3.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.3.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 156/216/292 ms
R1#ping vrf GREEN 172.16.3.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.3.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 168/236/288 ms
R1#ping vrf BLUE 192.168.3.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.3.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 152/226/376 ms
R1#sh ip route vrf RED

Routing Table: RED

      10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
C        10.0.1.0/24 is directly connected, FastEthernet2/0
L        10.0.1.1/32 is directly connected, FastEthernet2/0
D        10.0.3.0/24 [90/204800] via 10.0.12.2, 00:05:10, FastEthernet0/0.1
C        10.0.12.0/24 is directly connected, FastEthernet0/0.1
L        10.0.12.1/32 is directly connected, FastEthernet0/0.1
D        10.0.23.0/24 [90/153600] via 10.0.12.2, 00:15:15, FastEthernet0/0.1

R2#sh ip route vrf RED

Routing Table: RED

      10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
D        10.0.1.0/24 [90/153600] via 10.0.12.1, 00:46:14, FastEthernet0/0.1
D        10.0.3.0/24 [90/153600] via 10.0.23.3, 00:05:06, FastEthernet2/0.1
C        10.0.12.0/24 is directly connected, FastEthernet0/0.1
L        10.0.12.2/32 is directly connected, FastEthernet0/0.1
C        10.0.23.0/24 is directly connected, FastEthernet2/0.1
L        10.0.23.2/32 is directly connected, FastEthernet2/0.1

R3#ping vrf RED 10.0.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 184/238/324 ms
R3#ping vrf GREEN 172.16.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 168/216/264 ms
R3#ping vrf BLUE 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 204/232/296 ms
R3#sh ip route vrf RED

Routing Table: RED

      10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
D        10.0.1.0/24 [90/204800] via 10.0.23.2, 00:08:30, FastEthernet2/0.1
C        10.0.3.0/24 is directly connected, FastEthernet0/0
L        10.0.3.3/32 is directly connected, FastEthernet0/0
D        10.0.12.0/24 [90/153600] via 10.0.23.2, 00:08:30, FastEthernet2/0.1
C        10.0.23.0/24 is directly connected, FastEthernet2/0.1
L        10.0.23.3/32 is directly connected, FastEthernet2/0.1

That's all! Thank You. 


0 Comments: