topic Guest VRF issues in Switching

Guest VRF issues

Andrew Cormier — Thu, 07 Mar 2019 18:32:19 GMT

hi!

I am trying to set up a vrf for guest networks and am having issues on one of the switches.

A quick overview (since I dont really know what i am doing )

we have two sites that are connected via lanex. each site has a 3750.

The only internet connectivity is the remote site (so all the users at the local site route out through the remote site to get to the internet)

I need to make a guest network at the local site using our current infrastructure but it cannot have any access to our network resources.

I have created a vlan here (vl166) and on the remote switch

ip vrf TRAINING

didnt do any route distribution

then added "ip vrf forwarding TRAINTING" and readded the ip to the vlan interface

gave it an ip address of 172.16.166.1

did the exact same thing on the remote switch but with interface address of .2

enabled ospf on both switches.... router ospf 3 vrf TRAINING

I cant ping from one interface to the other... when I try pinging from the remote switch I get :

CISCO3750MCI-1#ping vrf TRAINING 172.16.166.1

% VRF does not have a usable source address

CISCO3750MCI-1#show ip vrf interfaces TRAINING

Interface IP-Address VRF Protocol

Vl16 172.16.16.2 TRAINING down

I cant see why the interface is down. Nothing in the logs (even when I do no shut... it just accepts the command but doesnt come up)

Thoughts?

Thhanks

Drew

Guest VRF issues

cadet alain — Tue, 11 Dec 2012 15:02:44 GMT

Hi,

Have you got any device connected to a access port in this VLAN or to a trunk port allowing this VLAN?

In the negative then its normal behaviour that the SVI is down.

Regards.

Alain

Don't forget to rate helpful posts.

Guest VRF issues

Andrew Cormier — Tue, 11 Dec 2012 15:26:59 GMT

Hi Alain,

If i do sho vl br I see...

VLAN Name Status Ports

---- -------------------------------- --------- --------------

1 default active Gi1/0/1, Gi1/012 Gi1/0/24,

116 TRAINING active

so I dont think it is being used. I had just created it yesterday afternoon.

Guest VRF issues

cadet alain — Tue, 11 Dec 2012 15:43:40 GMT

Hi,

so there is no access ports in this vlan configured, create one and plug a host and your SVI will come up.

Regards.

Alain

Don't forget to rate helpful posts.

Guest VRF issues

Andrew Cormier — Tue, 11 Dec 2012 16:14:26 GMT

Thanks Alain but I dont think that is a possible solution. What would I plug into it? We are using the switches as routers in this case. There is nothing that needs to be in that vlan on the remote site. Any other ideas?

Guest VRF issues

Giuseppe Larosa — Tue, 11 Dec 2012 16:31:01 GMT

Hello Andrew,

as a minimum the Vlan 166 has to be permitted on the link between switches and the link between switches/sites has to become a L2 trunk carrying multiple Vlans including Vlan 166.

With VRF lite you need to build a complete end to end logical topology for the new VRF.

Each VRF needs one Vlan in each link and the way to multiplex Vlans is to use an L2 802.1Q trunk between multilayer switches.

Check the link between the two sites.

CAUTION: if a configuration change is needed you need to work carefully to avoid to isolate the two sites

Hope to help

Giuseppe

Guest VRF issues

Andrew Cormier — Tue, 11 Dec 2012 16:56:34 GMT

Thanks Giuseppe! I think we are ok for the link since there is already a functioning VRF between the two switches.

I am not quite sure why the vlan is down on one end but up on the other. I just tried recreating the vlan int and vrf ... didnt help lol

Re: Guest VRF issues

Giuseppe Larosa — Tue, 11 Dec 2012 17:01:50 GMT

Hello Andrew,

check the list of permitted vlans on each end of the inter site link with

show interface type x/y trunk

show interface type x/y switchport

the new vlan may be missing on one side of the trunk, and if so this explains why the SVI is down.

Hope to help

Giuseppe

Guest VRF issues

Andrew Cormier — Tue, 11 Dec 2012 18:24:02 GMT

Thank Alain adn Giuseppe!!

Checked the trun port configs between the two switches and we were not allowing that vlan.

When you said check the list of permitted vlans a light went on in my head

That part works now .. now to get the rest going