Hi,
In case you want to use VRFs you can achieve this by
1) configure MP-BGP on your 6509
2) connect each separate office/VLAN in a separate VRF
3) create an Internet VRF and insert a default route
4) import all office routes into the Internet VRF and exort the default route to all office VRFs
5) connect the Internet VRF directly to a firewall preventing office to office connectivity, doing the NAT and secure everything against the internet.
The last point is important, because if you connect a router to the internet VRF, it would have all offoce routes and would again interconnect them. Basically one office A would be able to send packets to another office B by first following the default route and the CE would then send the packets back to the office B based on longest match routing.
A second option would be to use a FWSM separate the different offices by using the firewall functionality. This would also allow for greater control and optionally for office to office traffic, if this requirement would ever arise.
Hope this helps!
Regards, Martin
